Commit dev compose, gitignore volumes, unify image registry

[HermanPlay]

Context

Repo hygiene on branch feat/signed-url-file-storage-access (PR #4). Working tree has untracked files that should be tracked or ignored.

Problems

1. docker-compose/docker-compose.dev.yaml untracked — the dev environment is currently only reproducible from an uncommitted file. Should be committed (it differs from prod: ghcr images, no published internal ports, local secrets, http://localhost URLs).
2. docker-compose/volumes/ untracked — contains live pgdata + file-storage-media bind data. .gitignore only has .DS_Store, so DB/object data could accidentally be committed. Should be gitignored.
3. Image registry drift — prod uses seber/maxit-file-storage:latest / maxit/backend:latest / maxit/frontend:latest, dev uses ghcr.io/mini-maxit/*. file-storage + worker publish to GHCR (workflow in each repo); backend/frontend GHCR workflows may not exist. Unify or document which registry is canonical for each service.

Required changes

• Commit docker-compose.dev.yaml.
• Add volumes/ (and any other local-data dirs) to .gitignore.
• Decide canonical images per service (GHCR vs Docker Hub); align compose files; update GHCR/Docker publish workflows accordingly.

Acceptance criteria

• Fresh clone + docker compose -f docker-compose.dev.yaml up works.
• git status clean of data volumes.
• Compose files reference consistent image sources.