feat(dev): mirrorstack dev — run a module locally with docker pg

[I-am-nothing]

Summary

New top-level subcommand. Brings up a vendored Postgres via docker-compose, spawns the user's `go run .`, line-prefixes its output, and tears down on Ctrl-C.

Flow

```
$ cd my-module
$ mirrorstack dev
✓ bootstrapped docker-compose.yml
[+] Running 2/2
✔ Network mymod_default Created
✔ Container mirrorstack-dev-pg Healthy
✓ module running — Ctrl-C to stop
module │ mirrorstack: my-module module (My Mod) listening on :8080
…
^C
[+] Running 2/2
✔ Container mirrorstack-dev-pg Removed
✔ Network mymod_default Removed
```

Flags

Flag	Default	Notes
`--dir `	cwd	Where main.go lives
`--no-compose`	off	Use your own running pg; requires `MS_LOCAL_DB_URL`
`--db-url `	bundled	Override the default; highest precedence

Port choice

Bundled Postgres binds host port 5433 (not 5432). Lets `mirrorstack dev` co-exist with api-platform's own `docker-compose.yml` (which uses 5432) when developing platform + module side by side. Comment in the template explains.

Not in scope

• WSS tunnel client — separate PR. Module runs as a plain HTTP server on its own port for now.
• Graceful SIGTERM-then-SIGKILL — current shutdown is `child.kill()` (SIGKILL on unix). Reviewer flagged this for Go modules mid-DB-write; queued as a follow-up since it requires an extra dep (libc/nix) and Windows divergence handling. Acceptable for v1: a dev shell where the user owns the DB and restarts are cheap.

Test plan

• `cargo test` — 33 tests pass (8 new for dev)
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --all -- --check` clean
• Manual end-to-end: scaffold a module, `mirrorstack dev`, hit `localhost:8080/health`, Ctrl-C, confirm container is gone

/simplify pass

Three reviewers ran in parallel. Five fixes applied:

• `docker compose up --wait` (was: 500ms client-side polling loop) — drops ~30 lines, removes brittle JSON-substring check
• `compose down` now surfaces non-zero exit (was: silent leak)
• Boolean trap in `forward_lines(to_stderr)` → `forward_stdout`/`forward_stderr` thin wrappers around a closure-driven inner
• `line_prefix` visibility: `pub(crate)` → `pub(super)` (only used inside dev/)
• Template comment + `DEFAULT_DB_URL` flagged port collision with api-platform; switched to 5433

🤖 Generated with Claude Code