docs(setup): add Debian 13 dev-VM setup procedure + scripts + devcontainer

New procedure in docs/setup/01-dev-debian-vm-setup.md targeting the new
dev VM (10.100.201.21, Debian 13) that replaces the WSL workflow. The
existing setup files are renumbered (01->02, 02->03, 03->04) to free
prefix 01 for the default flow.

10 modular idempotent scripts under docs/setup/scripts/ install the
stack: zsh + Oh My Zsh + Powerlevel10k + plugins, modern CLI tooling
(bat, eza, fd-find, ripgrep, fzf, zoxide, ncdu, keychain + dev extras),
nvm + Node from .nvmrc + corepack + pnpm, Docker CE + compose plugin,
inotify watches + swap + hostname tuning, best-effort UFW + sshd
hardening that probes-before-applying, and notes/aliases.zsh +
notes/gitconfig.txt installation.

A systemd template (apf-portal-infra@.service) auto-starts the local
dev infra stack at boot per user.

.devcontainer/ ships a VSCode Dev Container spec pinning Node 24 and
attaching to the host's apf-portal-dev Compose network so postgres /
redis / otel resolve by DNS from inside the container. initializeCommand
fails fast if the infra hasn't been brought up yet.

CLAUDE.md Environment conventions documents the two envs (local +
development) plus the hybrid sub-mode (workstation IDE + VM infra via
SSH LocalForward) and the two IDE flows (Remote-SSH + Devcontainer).

Adjacent follow-ups (not in this PR): preview infra on the GitLab VM
(10.100.201.10), GitLab Runner migration alongside the Gitea -> GitLab
cutover, private dotfiles repo.

docs/setup/systemd/apf-portal-infra@.service

@@ -0,0 +1,41 @@
+# Auto-starts the apf-portal local-dev infrastructure stack at boot.
+#
+# This is a TEMPLATE unit (note the trailing `@`). The instance name is the
+# Linux username of the dev who owns the clone — the unit reads
+# `/home/<user>/Works/apf_portal/infra/local/dev.compose.yml`.
+#
+# Install:
+#   sudo cp docs/setup/systemd/apf-portal-infra@.service /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now apf-portal-infra@$USER.service
+#
+# Override the working directory if your clone lives elsewhere:
+#   sudo systemctl edit apf-portal-infra@$USER.service
+#   # Add: [Service]
+#   #      Environment="REPO=/custom/path/to/apf_portal"
+#   #      WorkingDirectory=
+#   #      WorkingDirectory=${REPO}
+#   #      ExecStart=
+#   #      ExecStart=${REPO}/infra/local/dev.sh up
+#   #      ExecStop=
+#   #      ExecStop=${REPO}/infra/local/dev.sh down
+
+[Unit]
+Description=apf-portal local infrastructure (postgres + redis + otel) for %i
+Requires=docker.service
+After=docker.service network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+User=%i
+Group=%i
+WorkingDirectory=/home/%i/Works/apf_portal
+ExecStart=/home/%i/Works/apf_portal/infra/local/dev.sh up
+ExecStop=/home/%i/Works/apf_portal/infra/local/dev.sh down
+TimeoutStartSec=180
+TimeoutStopSec=60
+
+[Install]
+WantedBy=multi-user.target