fix(dev): filter compose environment secrets

[eshurakov]

Summary

• generate a filtered, owner-only Compose env file instead of passing the full Vercel .env.local to Docker Compose
• normalize surrounding quotes in shared web-environment values
• document the scoped Compose secret handling

Testing

• pnpm test:web-env
• pnpm exec tsx --test dev/local/runner-compose-env.test.ts
• pnpm test:dev-local (206 passed; one unrelated tmux integration test failed to find its temporary pane-output file)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (8 files)

• dev/local/runner.ts — new composeInterpolatedKeys / formatComposeEnvAssignment / writeComposeSecretsEnvFile and startInfra env-file filtering; verified quoting/escaping round-trips through Compose's dotenv parser, owner-only 0o600 permissions (incl. chmod on rewrite), stale-file removal, and preserved --env-file precedence
• dev/local/runner-compose-env.test.ts — thorough coverage: key extraction, quoting, filtering, auto-pickup of new interpolations, file permissions, stale removal, no-match
• scripts/web-env/shared.ts — stripSurroundingQuotes correctness on edge cases (mismatched quotes, single char, empty pair, multiline)
• scripts/web-env/index.ts — strip applied consistently to file values, prompts, and tracked defaults; composes correctly with normalizeFileValue and setEnvDefault's JSON quoting
• scripts/web-env/shared.test.ts — new quote-stripping tests
• dev/local/cli.ts — comment-only change, accurate
• DEVELOPMENT.md — docs match implementation
• dev/grafana/README.md — docs match implementation

Additional checks: generated dev/.env.compose-secrets is covered by .gitignore (.env* pattern) and skipped by env-sync discovery (dev/ is in SKIP_DIRS); no HTML img tags in markdown changes; no memory-leak surface introduced (sync file I/O only, no timers/listeners/caches); compose file uses only braced ${VAR} interpolations matched by the extraction regex.

---

_{Reviewed by kimi-k3 · Input: 57.4K · Output: 17.1K · Cached: 739.4K}

_{Review guidance: REVIEW.md from base branch main}