docs(setup): add Debian 13 dev-VM setup procedure + scripts + devcontainer

New procedure in docs/setup/01-dev-debian-vm-setup.md targeting the new
dev VM (10.100.201.21, Debian 13) that replaces the WSL workflow. The
existing setup files are renumbered (01->02, 02->03, 03->04) to free
prefix 01 for the default flow.

10 modular idempotent scripts under docs/setup/scripts/ install the
stack: zsh + Oh My Zsh + Powerlevel10k + plugins, modern CLI tooling
(bat, eza, fd-find, ripgrep, fzf, zoxide, ncdu, keychain + dev extras),
nvm + Node from .nvmrc + corepack + pnpm, Docker CE + compose plugin,
inotify watches + swap + hostname tuning, best-effort UFW + sshd
hardening that probes-before-applying, and notes/aliases.zsh +
notes/gitconfig.txt installation.

A systemd template (apf-portal-infra@.service) auto-starts the local
dev infra stack at boot per user.

.devcontainer/ ships a VSCode Dev Container spec pinning Node 24 and
attaching to the host's apf-portal-dev Compose network so postgres /
redis / otel resolve by DNS from inside the container. initializeCommand
fails fast if the infra hasn't been brought up yet.

CLAUDE.md Environment conventions documents the two envs (local +
development) plus the hybrid sub-mode (workstation IDE + VM infra via
SSH LocalForward) and the two IDE flows (Remote-SSH + Devcontainer).

Adjacent follow-ups (not in this PR): preview infra on the GitLab VM
(10.100.201.10), GitLab Runner migration alongside the Gitea -> GitLab
cutover, private dotfiles repo.

docs/setup/scripts/bootstrap.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Orchestrator — runs every numbered setup script in order with a confirmation prompt.
+# Each script is also runnable individually:
+#   ./docs/setup/scripts/40-node.sh
+# See docs/setup/01-dev-debian-vm-setup.md for the step-by-step doc.
+
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=./lib.sh
+source "$HERE/lib.sh"
+
+require_debian
+require_not_root
+
+SCRIPTS=(
+  10-base-packages.sh
+  20-zsh.sh
+  30-cli-tools.sh
+  40-node.sh
+  50-docker.sh
+  60-tuning.sh
+  70-hardening.sh
+  80-dotfiles.sh
+)
+
+log "Bootstrap will run, in order:"
+for s in "${SCRIPTS[@]}"; do
+  printf '  - %s\n' "$s"
+done
+echo
+
+if ! confirm "Continue?"; then
+  log "Aborted before any change."
+  exit 0
+fi
+
+for s in "${SCRIPTS[@]}"; do
+  echo
+  log "═══ $s ═══"
+  if confirm "Run $s now?"; then
+    "$HERE/$s"
+    ok "$s done"
+  else
+    skip "$s"
+  fi
+done
+
+echo
+ok "Bootstrap complete."
+log "Next steps:"
+printf '  - exec zsh -l            # reload shell to pick up zsh + PATH\n'
+printf '  - p10k configure         # only if you skipped during 20-zsh.sh\n'
+printf '  - cp infra/local/.env.example infra/local/.env && $EDITOR infra/local/.env\n'
+printf '  - ./infra/local/dev.sh up\n'
+printf '  - pnpm install\n'