Add Docker Compose stack with PostgreSQL and Caddy

Production traffic enters through Caddy, which terminates TLS for the public
domain and the CMS subdomain and sets HSTS and the other security headers.
PostgreSQL, Strapi and Nuxt publish no ports of their own.

docker-compose.dev.yml publishes the ports on localhost and drops Caddy for
local testing. It is a separate file rather than an override.yml so it can only
be applied when passed explicitly, never by accident in production.

docker-compose.dev.yml

@@ -0,0 +1,20 @@
+# Local testing without domains or TLS: publishes the app ports on localhost and
+# leaves Caddy out. Never used in production — it must be passed explicitly:
+#   docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build cms frontend
+services:
+  database:
+    ports:
+      - "127.0.0.1:5432:5432"
+
+  cms:
+    ports:
+      - "127.0.0.1:1337:1337"
+    environment:
+      STRAPI_URL: http://localhost:1337
+
+  frontend:
+    ports:
+      - "127.0.0.1:3000:3000"
+    environment:
+      NUXT_PUBLIC_SITE_URL: http://localhost:3000
+      NUXT_PUBLIC_STRAPI_URL: http://localhost:1337