feat: add local development setup with Docker Compose

Complete local dev environment for testing:

**Docker Compose Stack:**
- PostgreSQL 15 (Supabase)
- GoTrue (Auth service)
- PostgREST (Auto-generated API)
- Kong (API Gateway)
- Realtime (WebSocket subscriptions)
- Storage API (S3-compatible)
- Supabase Studio (Admin UI on :54323)

**Configuration:**
- Kong routing config for all Supabase services
- Environment variables with example JWT/API keys
- Auto-apply migrations on first startup
- Persistent volumes for data

**Documentation:**
- DEV_SETUP.md with step-by-step guide
- Troubleshooting section
- Common tasks (reset DB, view logs, etc.)
- Pre-seeded data reference

**Bonus:**
- BarcodeScanner.vue component (Week 3 preview)
- html5-qrcode library installed

Ready to run: `docker-compose up -d && cd app && bun run dev`

Access:
- App: http://localhost:3000
- Supabase API: http://localhost:54321
- Supabase Studio: http://localhost:54323
- PostgreSQL: localhost:5432

docker/kong.yml

@@ -0,0 +1,85 @@
+_format_version: "2.1"
+
+_transform: true
+
+services:
+  - name: auth
+    url: http://auth:9999
+    routes:
+      - name: auth-v1
+        strip_path: true
+        paths:
+          - /auth/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+
+  - name: rest
+    url: http://rest:3000
+    routes:
+      - name: rest-v1
+        strip_path: true
+        paths:
+          - /rest/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+
+  - name: realtime
+    url: http://realtime:4000/socket
+    routes:
+      - name: realtime-v1
+        strip_path: true
+        paths:
+          - /realtime/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+
+  - name: storage
+    url: http://storage:5000
+    routes:
+      - name: storage-v1
+        strip_path: true
+        paths:
+          - /storage/v1
+    plugins:
+      - name: cors
+
+consumers:
+  - username: anon
+    keyauth_credentials:
+      - key: ${ANON_KEY}
+  - username: service_role
+    keyauth_credentials:
+      - key: ${SERVICE_ROLE_KEY}
+
+plugins:
+  - name: cors
+    config:
+      origins:
+        - "*"
+      methods:
+        - GET
+        - POST
+        - PUT
+        - PATCH
+        - DELETE
+        - OPTIONS
+      headers:
+        - Accept
+        - Accept-Encoding
+        - Authorization
+        - Content-Type
+        - Origin
+        - X-Client-Info
+      exposed_headers:
+        - X-Total-Count
+      credentials: true
+      max_age: 3600