build: make up and make image for local work

[WhiteMuush]

Closes #46 (closed manually on merge, closing keywords do not apply to develop).

Two make targets: one for developers to get the site, one to test the production image before it is published.

make up: the site for developers

make env then make up gives the site on http://localhost:3000 with hot reload and demo data. It failed on a fresh clone: the stack runs npm run seed:dev, whose prisma/seed.dev.ts was untracked as private in #165.

seed:dev now runs the admin seed, then a public demo seed (prisma/seed.demo.ts, data in prisma/demo/):

• 18 invented employees on the reserved example.com domain, so a demo scan can never reach a real person;
• 12 real public breaches, with names, dates, counts and data classes copied from the Have I Been Pwned API;
• 30 alerts in every status, scored by the scanner's own severityFor and normalizeType, worded like real scan alerts;
• safe to rerun: the second run gives the same 18 / 12 / 30.

make image: test the production image

• make image builds Dockerfile (the published image), runs it on http://localhost:3001 with its own Postgres, and prints the bootstrap invite link for admin@example.com, the same first-run path as a real deployment.
• make image-scan runs Trivy (HIGH, CRITICAL). make image-down removes containers, network, volume and secrets.
• Secrets (auth secret, encryption key, invite token, a random database password) are generated per instance in .image-local/ (mode 600, ignored by git and docker) and passed with --env-file, never on a command line.

Running next to the host database

compose.yml and make db-up both named their database container gardik-db, so after make db-down (which stops but keeps it) make up failed on a name conflict. The stack database is now gardik-stack-db, and make up stops early with "Stop it first with: make db-down" when the host database holds port 5432. Another PostgreSQL on 5432: POSTGRES_PORT=5433 make up.

Verified

• make up on a clean stack: migrations, admin, demo data, site on :3000; signed in, 18 example.com employees listed, dashboard populated.
• make image twice: invite link sets the password, sign-in reaches the dashboard, employees, sources and alerts pages load without errors.
• make image-scan: 0 HIGH or CRITICAL.
• make image-down leaves no container, volume or secret behind.
• make check green.

Docs

README and wiki (Getting Started, Development, Architecture) now say make up and make image, describe the demo data, and fix db:init, which starts Postgres through scripts/db-up.sh, not compose.yml.

Found while testing, not changed here

• HIBP password breaches are rated MEDIUM instead of HIGH. The scanner stores HIBP's "Passwords" class as passwords, while severityFor looks for password. The demo shows it: all 30 alerts are MEDIUM.
• The "Incident Timeline" and "Breach Sources" widgets only show breaches from a currently connected source, while the top counters show all; with no source connected they stay empty next to 30 detections.