fix(infra): exclude serve-static from 'dev.sh up all' (port collision with apps)

dev.sh up all failed at startup with 'port 4200 already allocated':
both the apps profile (portal-shell dev-server, ADR-0030) and the
serve-static profile (Caddy reverse proxy) publish 4200 by default.

Split ALL_PROFILES (teardown / status / logs scope, unchanged) from
a new UP_ALL_PROFILES (what 'up all' expands to). serve-static drops
out of up all because:
- it collides with apps on 4200, and
- it has zero value without a prior nx build --configuration=production
  (otherwise Caddy 404s every request).

serve-static stays explicit: ./infra/local/dev.sh up serve-static.
Teardown still catches it via ALL_PROFILES.

Usage text + infra/README.md cheat-sheet updated.

The script is environment-agnostic — works the same on local and on
vm-dev. No local-vs-vm mode needed.

infra/local/dev.sh

@@ -14,10 +14,23 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 COMPOSE_FILE="${SCRIPT_DIR}/dev.compose.yml"
 
-# Profiles defined in dev.compose.yml. Keep in sync if a new profile
-# is added.
+# Every profile defined in dev.compose.yml, used as the teardown /
+# status / logs scope so a profile started under a custom flag is
+# always reachable later. Keep in sync if a new profile is added.
 ALL_PROFILES=(dbtools observability serve-static apps)
 
+# What `up all` expands to — everything you want running for a full
+# dev session. `serve-static` is deliberately excluded:
+#   - it would collide with `apps` on host port 4200 (both publish the
+#     SPA there by default — Caddy serves the production build, the
+#     `apps` profile runs the Angular dev-server);
+#   - without a prior `nx build --configuration=production`, Caddy
+#     just 404s every request, so it adds nothing to a comprehensive
+#     `up all` invocation. Users who actually need it run
+#     `./infra/local/dev.sh up serve-static` (and `down` still tears
+#     it down because it's in ALL_PROFILES above).
+UP_ALL_PROFILES=(dbtools observability apps)
+
 # Build "--profile p1 --profile p2 …" as separate arguments.
 build_all_profile_flags() {
   local p
@@ -56,7 +69,11 @@ Commands:
   up [target...]        Bring up the stack.
                         Targets:
                           (none)         core only (postgres + redis + otel-collector)
-                          all            core + all profiles
+                          all            core + dbtools + observability + apps —
+                                         the full dev stack. serve-static is
+                                         EXCLUDED because it collides with apps
+                                         on port 4200; run it explicitly when
+                                         you actually want to serve a prod build.
                           dbtools        core + pgweb
                           observability  core + jaeger
                           serve-static   core + caddy (production-build reverse proxy)
@@ -119,7 +136,7 @@ case "$cmd" in
     if [[ $# -eq 0 ]]; then
       dc_core up -d
     elif [[ "$1" == "all" ]]; then
-      dc_all up -d
+      up_with_profiles "${UP_ALL_PROFILES[@]}"
     else
       up_with_profiles "$@"
     fi