feat(dev): expose local stack for agent testing

[simonjcarr]

Summary

• add ./dev-stack.sh --public / --public-host for agent-connectable local development
• expose only the web proxy and ingest ports in public mode while keeping Postgres loopback-only
• advertise the reachable host to web, agent downloads, and agent ingest output
• regenerate dev TLS when the public host needs to be added to the cert SANs
• add --check-public and --local helpers
• fix dev env writes and idempotent restarts after the stack is already running

Validation

• bash -n dev-stack.sh
• bash deploy/scripts/test-dev-stack.sh
• go test ./internal/config from apps/ingest
• docker compose --project-name ct-ops-dev-compose-check --env-file .dev/dev.env -f docker-compose.dev-stack.yml config

Notes

• Public mode is opt-in; default local development remains loopback-only.
• A Tailscale IP is the recommended --public-host value for agent testing.