feat(dev): local docker-compose stack

Adds dev/docker-compose.yml + dev/keycloak/realm-export.json + dev/README.md
and Makefile targets so a developer can:

  make dev-up

and get Keycloak 26 on :8080 with the breakpilot-dev realm pre-imported,
plus pg-app (:5432), Redis (:6379), Mongo (:27017), and MinIO (:9000 + :9001).

Seed users:
  test@breakpilot.dev / test    — IT_ADMIN of tenant 'acme'
  admin@breakpilot.dev / admin  — BREAKPILOT_ADMIN (platform staff)

Realm includes a dev-portal public PKCE client (redirect URIs cover
http://localhost:3000/* and http://*.localhost:3000/* so subdomain routing
works in dev) and a dev-tenant-registry bearer-only client. Protocol
mappers project tenant_id, tenant_slug, org_roles, products, plan, and
tenant_status into every issued JWT — the contract portal + tenant-registry
expect in prod, fronted by Keycloak attributes today.

dev/ lives in orca-platform because this repo already documents the
production topology that this compose mirrors. INFRASTRUCTURE.md §1 sets
dev as 'docker-compose on developer laptops' — this is that compose.

Refs: M0.1+ (precondition for local-dev work on tenant-registry / portal)

Makefile

@@ -5,11 +5,18 @@
 #   make apply ENV=<env>       (M1.2+) push resolved set to Orca controller
 #   make diff ENV=<env>        alias for plan
 #   make clean                 remove .orca-out/
+#
+# Local dev stack (dev/docker-compose.yml):
+#   make dev-up                bring up Keycloak + Postgres + Redis + Mongo + MinIO
+#   make dev-down              stop, keep volumes
+#   make dev-reset             stop, wipe volumes, fresh start
+#   make dev-logs              tail logs from every service
 
-.PHONY: help validate plan apply diff clean
+.PHONY: help validate plan apply diff clean dev-up dev-down dev-reset dev-logs
 
 ENV ?=
 ORCA_API_URL ?=
+COMPOSE = docker compose -f dev/docker-compose.yml
 
 help:
 	@echo "orca-platform targets:"
@@ -18,6 +25,12 @@ help:
 	@echo "  make apply ENV=<env>       push resolved set (no-op until M1.2)"
 	@echo "  make diff ENV=<env>        alias for plan"
 	@echo "  make clean                 remove .orca-out/"
+	@echo ""
+	@echo "Local dev stack:"
+	@echo "  make dev-up                bring up the dev compose stack"
+	@echo "  make dev-down              stop, keep volumes"
+	@echo "  make dev-reset             stop, wipe volumes, fresh start"
+	@echo "  make dev-logs              tail logs"
 
 validate:
 	@./scripts/validate.sh
@@ -33,3 +46,18 @@ apply:
 clean:
 	@rm -rf .orca-out
 	@echo "removed .orca-out/"
+
+dev-up:
+	@$(COMPOSE) up -d
+	@echo "Keycloak: http://localhost:8080 (admin / admin-dev-pass on master realm)"
+	@echo "          realm 'breakpilot-dev', user test@breakpilot.dev / test"
+
+dev-down:
+	@$(COMPOSE) down
+
+dev-reset:
+	@$(COMPOSE) down -v
+	@$(COMPOSE) up -d
+
+dev-logs:
+	@$(COMPOSE) logs -f