dev: hot reload on file change

[I-am-nothing]

Goal

`mirrorstack dev` watches `.go` and `sql/**/.sql` in the module dir; on change, kills the Go process and respawns `go run .` with the same env. The whole point of `dev` is iteration, so this should be the default behavior with a `--no-watch` opt-out.

Sketch

• Use the `notify` crate for cross-platform fs events
• Debounce ~250ms (editors do multi-write saves)
• Globs to watch: `/*.go`, `sql//*.sql`. Skip `vendor/`, `testdata/`, `.git/`
• On change: send SIGTERM (or SIGKILL fallback) to the existing child, wait, respawn
• Keep docker-compose + (future) tunnel handle alive across reloads — only the Go process restarts

Acceptance

• Editing a file in main.go triggers a restart within ~500ms
• Tunnel session (once feat(dev): wire WSS tunnel into mirrorstack dev (--tunnel) #22 + WS API GW IaC land) survives reloads — same session_id
• Docker pg container is NOT restarted (data preserved)
• `--no-watch` skips the watcher entirely

Estimate

~150 LoC + tests. Independent of any unmerged work.