feat(dev): local docker-compose stack

Adds dev/docker-compose.yml + dev/keycloak/realm-export.json + dev/README.md
and Makefile targets so a developer can:

  make dev-up

and get Keycloak 26 on :8080 with the breakpilot-dev realm pre-imported,
plus pg-app (:5432), Redis (:6379), Mongo (:27017), and MinIO (:9000 + :9001).

Seed users:
  test@breakpilot.dev / test    — IT_ADMIN of tenant 'acme'
  admin@breakpilot.dev / admin  — BREAKPILOT_ADMIN (platform staff)

Realm includes a dev-portal public PKCE client (redirect URIs cover
http://localhost:3000/* and http://*.localhost:3000/* so subdomain routing
works in dev) and a dev-tenant-registry bearer-only client. Protocol
mappers project tenant_id, tenant_slug, org_roles, products, plan, and
tenant_status into every issued JWT — the contract portal + tenant-registry
expect in prod, fronted by Keycloak attributes today.

dev/ lives in orca-platform because this repo already documents the
production topology that this compose mirrors. INFRASTRUCTURE.md §1 sets
dev as 'docker-compose on developer laptops' — this is that compose.

Refs: M0.1+ (precondition for local-dev work on tenant-registry / portal)

README.md

@@ -42,6 +42,8 @@ The single source of truth for which container runs on which VM in which environ
 
 ## Run locally
 
+### IaC validation
+
 ```bash
 make validate                   # check all manifests parse + have required fields
 make plan ENV=stage             # resolve manifests for stage → .orca-out/stage/
@@ -51,6 +53,18 @@ make apply ENV=stage            # no-op until M1.2 stands up the Orca controller
 
 `make validate` runs in CI on every PR.
 
+### Dev stack
+
+`platform/orca-platform` doubles as the home for the local-dev compose stack so a developer can clone this repo, run `make dev-up`, and immediately work against a real Keycloak realm + Postgres / Redis / Mongo / MinIO. See [`dev/README.md`](./dev/README.md) for the full picture.
+
+```bash
+make dev-up                     # Keycloak (:8080) + Postgres (:5432) + Redis (:6379) + Mongo (:27017) + MinIO (:9000)
+make dev-down                   # stop, keep volumes
+make dev-reset                  # stop, wipe, fresh
+```
+
+Seed user: `test@breakpilot.dev` / `test` (tenant `acme`, products `certifai` + `compliance`).
+
 ## Per-milestone fill-in schedule
 
 Each stub manifest in `manifests/` carries a header comment naming the milestone that finalises its real values. Summary: