build: M1 Dockerized development stack with PHP skeleton, config/logging, Tailwind assets, and wrappers

Implements MeshVault M1 (issues #6–11):

- Four-service Docker Compose stack (nginx, PHP-FPM 8.3, PostgreSQL 17, Node assets)
- Slim 4 + PHP-DI routing with escaped PHP views and production/dev error handling
- Immutable validated AppConfig with redacted diagnostics
- JSON stdout Monolog logging with job-scoped context
- Tailwind CSS v4 deterministic locked builds with template scanning
- POSIX and PowerShell dev wrappers (up/down/test/lint/assets/watch)
- Startup config validation fails before FPM serves as unprivileged www-data
- migrate/seed explicitly unavailable until M2 (#12); #10 remains open

Verified via clean-start acceptance on remote host (keith@192.168.2.23).

dev.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+cd -- "$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
+cmd=${1:-}
+if [ "$#" -gt 0 ]; then shift; fi
+case "$cmd" in
+    migrate|seed) echo "$cmd unavailable until M2 (#12); #10 remains open" >&2; exit 1 ;;
+    down)
+        for arg do
+            case "$arg" in
+                --volumes*|-v) echo 'Volume removal is forbidden by this wrapper' >&2; exit 2 ;;
+            esac
+        done
+        exec docker compose down "$@" ;;
+    up) exec docker compose up -d --build "$@" ;;
+    test|lint) exec docker compose run --rm --no-deps -T --entrypoint composer app "$cmd" "$@" ;;
+    assets) exec docker compose run --rm --no-deps -T assets npm run build -- "$@" ;;
+    watch|assets:watch) exec docker compose run --rm --no-deps -T assets npm run watch -- "$@" ;;
+    *) echo 'Usage: dev.sh up|down|test|lint|assets|watch|migrate|seed [arguments]' >&2; exit 2 ;;
+esac
+