Decouple dev compose stack from itkdev-docker tooling

[turegjorup]

Summary

A fresh git clone && task site-install now works end-to-end on any host with Docker Compose v2 + Task — no itkdev-docker-compose wrapper, no pre-created external frontend network, no host-level traefik required. Itkdev workflows keep working via dotenv opt-in.

• Bundled dev traefik behind profiles: [traefik] (on by default), terminating TLS on :80/:443 with a self-signed cert. Generated on demand by task dev:cert (alpine/openssl in a transient container), chained into task compose-up. Profile-aware: itkdev devs with COMPOSE_PROFILES= in .env.local get a no-op skip.
• Consolidated to a single docker-compose.yml for the dev stack. The four ITK-hosting-specific files (docker-compose.{override,server,dev,redirect}.yml) are dropped; previously-overridden services (redis, node, playwright, markdownlint, prettier) are merged into the base. mailpit removed (the app sends no mail).
• ${COMPOSE_FRONTEND_NETWORK} parameterizes both the network's engine name and the traefik.docker.network labels — default display_frontend won't collide with the shared frontend network itkdev hosts use, so devs can switch between bundled and host-level traefik without manual cleanup.
• docker-compose.shared-frontend.yml overlay for itkdev opt-in: flips frontend to external. The required .env.local block (COMPOSE_PROFILES=, COMPOSE_FILE, COMPOSE_FRONTEND_NETWORK=frontend) is documented in .env and the README's new "Itkdev developers: host-level traefik opt-in" section.
• Taskfile.yml: DOCKER_COMPOSE defaults to plain docker compose; the legacy itkdev-docker-compose wrapper remains available via TASK_DOCKER_COMPOSE=itkdev-docker-compose in .env.local.
• New Compose workflow lints all four operational modes (default, default + dev tools, postgres overlay, itkdev opt-in) and smoke-tests both default and itkdev stacks. Path-scoped to compose files, traefik config, dev-cert script, and .env.

Test plan

• Default mode: git clone && task site-install succeeds on a host with only Docker Compose v2 + Task installed, no itkdev tooling.
• task dev:cert generates traefik/ssl/dev.{crt,key} covering COMPOSE_DOMAIN and node-${COMPOSE_DOMAIN}. Second run says "already exists" and exits 0.
• https://${COMPOSE_DOMAIN}/health returns 200 through the bundled traefik (accepts self-signed cert).
• Itkdev opt-in: with .env.local containing COMPOSE_PROFILES=, COMPOSE_FILE=docker-compose.yml:docker-compose.shared-frontend.yml, COMPOSE_FRONTEND_NETWORK=frontend, task site-install attaches to the host-level traefik on the external frontend network. task dev:cert reports "skipping dev cert."
• Switching between default and itkdev modes (with task compose -- down -v between switches) doesn't leave colliding networks.
• task coding-standards:yml/markdown/assets:* still run via the now profile-gated prettier/markdownlint services.
• CI: the new Compose workflow passes; Doctrine and other unrelated workflows are unaffected.

🤖 Generated with Claude Code