feat(infra): dockerised full-stack dev mode — apps compose profile (ADR-0030)

Add an 'apps' Compose profile that runs the three Nx dev servers
(portal-bff, portal-shell, portal-admin) from a shared Dockerfile.dev,
so the whole stack boots with 'dev.sh up apps' and no native Node/pnpm.

- Dockerfile.dev: node:24-bookworm + corepack (pnpm from packageManager
  at runtime), NX_DAEMON=false. No build-time COPY/install.
- dev-entrypoint.sh: BFF runs prisma generate + migrate deploy then
  serves; SPA services go straight to nx serve.
- dev.compose.yml: one-shot apps-deps installs into a shared
  node_modules volume once (apps gate on its completion, no install
  race); repo bind-mounted, node_modules + .nx in named volumes; BFF
  reuses its own .env (required:false) with host URLs overridden to
  Compose service names.
- dev.sh: apps added to ALL_PROFILES + usage.
- Docs: which-mode-when table (setup doc), apps section (infra README),
  CLAUDE.md roll-up. ADR-0030 flipped to accepted.

Dev-only; production images stay with the ADR-0028 Container Registry
work. Additive + profile-gated — native and devcontainer flows
unchanged. Full-boot validation pending on a Docker host (see PR body).

docs/decisions/0030-dockerised-dev-mode.md

@@ -1,5 +1,5 @@
 ---
-status: proposed
+status: accepted
 date: 2026-05-28
 decision-makers: R&D Lead
 tags: [infrastructure, process]
@@ -109,4 +109,4 @@ The follow-up PR documents this table in `docs/setup/`:
 - The BFF entrypoint's `prisma generate` + `migrate deploy` follows [ADR-0006](0006-persistence-postgresql-prisma.md); migrations are applied, never authored, inside the container.
 - Production images are **out of scope** and tracked against the [ADR-0028](0028-migrate-cicd-and-git-hosting-to-gitlab.md) Container Registry follow-up (post-cutover).
 - Builds on the existing [`infra/local/dev.compose.yml`](../../infra/local/dev.compose.yml) profiles pattern (`dbtools`, `observability`, `serve-static`) — `apps` is one more profile in the same idiom.
-- Status is `proposed`; on acceptance, update the CLAUDE.md architecture roll-up and add the "which mode when" guidance to `docs/setup/`.
+- Accepted; the implementation PR carries the `Dockerfile.dev`, the `apps` Compose profile, the BFF entrypoint, the CLAUDE.md architecture roll-up entry, and the "which mode when" guidance in `docs/setup/`.

docs/decisions/README.md

@@ -72,4 +72,4 @@ ADRs are listed in numerical order. To slice by topic, filter on the `Tags` colu
 | [0026](0026-person-user-portal-data-model.md)                | `Person` golden record + `User` portal-account — portal-side identity model                                      | accepted | `data`, `backend`, `security`                                  | 2026-05-24 |
 | [0027](0027-portal-side-organisational-hierarchy.md)         | Portal-side organisational hierarchy — `Structure` with kind discriminator and nullable FINESS / SIRET           | accepted | `data`, `backend`                                              | 2026-05-24 |
 | [0028](0028-migrate-cicd-and-git-hosting-to-gitlab.md)       | Migrate CI/CD + git hosting from Gitea to GitLab self-hosted                                                     | accepted | `infrastructure`, `process`                                    | 2026-05-26 |
-| [0030](0030-dockerised-dev-mode.md)                          | Dockerised full-stack dev mode — `compose up` runs the Nx apps alongside infra                                   | proposed | `infrastructure`, `process`                                    | 2026-05-28 |
+| [0030](0030-dockerised-dev-mode.md)                          | Dockerised full-stack dev mode — `compose up` runs the Nx apps alongside infra                                   | accepted | `infrastructure`, `process`                                    | 2026-05-28 |

docs/setup/01-dev-debian-vm-setup.md

@@ -203,6 +203,24 @@ pnpm exec nx run-many -t lint test --parallel=3   # smoke test
 
 ## Step 5 — Choose your IDE flow
 
+### Running the apps — three modes (which when)
+
+There are three ways to run the apps locally. They coexist; pick by need.
+
+| Mode                              | Toolchain on host  | Best for                                                                                  |
+| --------------------------------- | ------------------ | ----------------------------------------------------------------------------------------- |
+| **Native** (`pnpm nx serve`)      | Node + pnpm native | Day-to-day dev — fastest iteration, simplest debugger attach.                             |
+| **Devcontainer** (Option B below) | none (Docker)      | IDE-integrated dev with no native toolchain; VSCode attaches, you run `nx serve` inside.  |
+| **Compose `apps` profile**        | none (Docker)      | "Run everything with one command" — onboarding, frontend-only work, demos. No IDE attach. |
+
+The Compose `apps` profile (per [ADR-0030](../decisions/0030-dockerised-dev-mode.md)) is the lightest way to boot the full stack without a native toolchain:
+
+```bash
+./infra/local/dev.sh up apps   # infra + portal-bff:3000 + portal-shell:4200 + portal-admin:4300
+```
+
+Usage, prerequisites (the BFF still needs its `apps/portal-bff/.env` secrets) and the port caveat are documented in [infra/README.md](../../infra/README.md) → "Dockerised app dev mode". The IDE-flow options below (Remote-SSH / Devcontainer / Hybrid) are orthogonal — they decide where your editor + terminals run, not how the apps boot.
+
 ### Option A — VSCode Remote-SSH (default)
 
 From your workstation: