docs(setup): add Debian 13 dev-VM setup procedure + scripts + devcontainer

New procedure in docs/setup/01-dev-debian-vm-setup.md targeting the new
dev VM (10.100.201.21, Debian 13) that replaces the WSL workflow. The
existing setup files are renumbered (01->02, 02->03, 03->04) to free
prefix 01 for the default flow.

10 modular idempotent scripts under docs/setup/scripts/ install the
stack: zsh + Oh My Zsh + Powerlevel10k + plugins, modern CLI tooling
(bat, eza, fd-find, ripgrep, fzf, zoxide, ncdu, keychain + dev extras),
nvm + Node from .nvmrc + corepack + pnpm, Docker CE + compose plugin,
inotify watches + swap + hostname tuning, best-effort UFW + sshd
hardening that probes-before-applying, and notes/aliases.zsh +
notes/gitconfig.txt installation.

A systemd template (apf-portal-infra@.service) auto-starts the local
dev infra stack at boot per user.

.devcontainer/ ships a VSCode Dev Container spec pinning Node 24 and
attaching to the host's apf-portal-dev Compose network so postgres /
redis / otel resolve by DNS from inside the container. initializeCommand
fails fast if the infra hasn't been brought up yet.

CLAUDE.md Environment conventions documents the two envs (local +
development) plus the hybrid sub-mode (workstation IDE + VM infra via
SSH LocalForward) and the two IDE flows (Remote-SSH + Devcontainer).

Adjacent follow-ups (not in this PR): preview infra on the GitLab VM
(10.100.201.10), GitLab Runner migration alongside the Gitea -> GitLab
cutover, private dotfiles repo.

.devcontainer/devcontainer.json

@@ -0,0 +1,65 @@
+// `apf-portal` devcontainer — VSCode Dev Containers spec.
+//
+// Pinned Node + pnpm via corepack via the official typescript-node image
+// (Bookworm base). The container has access to the host docker daemon
+// through the docker socket (`docker-outside-of-docker` feature), so
+// `infra/local/dev.sh up` on the HOST creates the postgres/redis/otel
+// containers and this container connects to them through the shared
+// `apf-portal-dev` network.
+//
+// Workflow:
+//   1. On the host: ./infra/local/dev.sh up           (creates the network)
+//   2. In VSCode: F1 → "Dev Containers: Reopen in Container"
+//   3. Inside the container: pnpm exec nx serve portal-bff (connects to postgres:5432)
+{
+  "name": "apf-portal",
+  "image": "mcr.microsoft.com/devcontainers/typescript-node:1-24-bookworm",
+  "features": {
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {},
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "installZsh": false,
+      "configureZshAsDefaultShell": false
+    }
+  },
+  // `initializeCommand` runs on the HOST before the container starts.
+  // Fail fast if the infra network isn't up — otherwise the BFF would
+  // get connection-refused on every Postgres query inside the container.
+  "initializeCommand": "docker network inspect apf-portal-dev > /dev/null 2>&1 || { echo '❌ Bring up infra first: ./infra/local/dev.sh up' >&2 ; exit 1 ; }",
+  // Attach to the same Compose network as postgres/redis/otel so DNS
+  // resolution (`postgres:5432`) works from inside the container.
+  "runArgs": ["--network=apf-portal-dev"],
+  "forwardPorts": [4200, 4300, 3000, 8081, 16686, 4317, 4318],
+  "portsAttributes": {
+    "4200": { "label": "portal-shell", "onAutoForward": "notify" },
+    "4300": { "label": "portal-admin", "onAutoForward": "notify" },
+    "3000": { "label": "portal-bff", "onAutoForward": "notify" },
+    "8081": { "label": "pgweb", "onAutoForward": "silent" },
+    "16686": { "label": "jaeger UI", "onAutoForward": "silent" },
+    "4317": { "label": "otel gRPC", "onAutoForward": "silent" },
+    "4318": { "label": "otel HTTP", "onAutoForward": "silent" }
+  },
+  "postCreateCommand": "bash .devcontainer/post-create.sh",
+  "remoteUser": "node",
+  "containerEnv": {
+    // Nx + Angular CLI memory ceiling — 4 GB. Bumping past the default
+    // 2 GB avoids OOM in `nx build` on large monorepos.
+    "NODE_OPTIONS": "--max-old-space-size=4096"
+  },
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "dbaeumer.vscode-eslint",
+        "esbenp.prettier-vscode",
+        "Angular.ng-template",
+        "Prisma.prisma",
+        "ms-azuretools.vscode-docker",
+        "EditorConfig.EditorConfig"
+      ],
+      "settings": {
+        "terminal.integrated.defaultProfile.linux": "bash",
+        "editor.formatOnSave": true,
+        "editor.defaultFormatter": "esbenp.prettier-vscode"
+      }
+    }
+  }
+}