fix(dev): support root bind mounts and LAN Vite access

Keep the dev container as root for s6 init so composer can create
vendor/ on root-owned mounts, then chown writable paths to www-data.
Move init-setup into a shell script and expose VITE_HOST/PORT for
remote HMR (LAN/Tailscale) with Vite listening on 0.0.0.0.

docker/development/Dockerfile

@@ -98,5 +98,8 @@ RUN mkdir -p /etc/nginx/conf.d && \
 COPY --from=minio-client /usr/bin/mc /usr/bin/mc
 RUN chmod +x /usr/bin/mc
 
-# Switch to non-root user
-USER www-data
+# Stay as root for s6 init so bind-mounted workspaces work even when the host
+# tree is root-owned (CI, Jean, rootful Docker). PHP-FPM/nginx still run as
+# www-data via their service configs. Do NOT set USER www-data here — that
+# makes init-setup (composer install) fail with "vendor could not be created".
+USER root

docker/development/etc/s6-overlay/s6-rc.d/init-setup/up

@@ -1,22 +1,6 @@
 #!/command/execlineb -P
 
-# Use with-contenv to ensure environment variables are available
+# s6 oneshots are execline pipelines (shebang shell scripts are not run as sh).
+# Delegate to a real shell script for readable setup logic.
 with-contenv
-cd /var/www/html
-foreground {
-    composer
-    install
-}
-foreground {
-    php
-    artisan
-    migrate
-    --step
-}
-foreground {
-    php
-    artisan
-    dev
-    --init
-}
-
+/etc/s6-overlay/scripts/init-setup.sh

docker/development/etc/s6-overlay/scripts/init-setup.sh

@@ -0,0 +1,42 @@
+#!/command/with-contenv sh
+set -eu
+
+cd /var/www/html
+
+# When the project is bind-mounted, host ownership may be root:root while the
+# app runs as www-data (UID 1000). Fix the minimum needed so composer/laravel
+# can write, without a recursive chown of the whole tree.
+prepare_bind_mount() {
+    mkdir -p \
+        storage/framework/cache \
+        storage/framework/sessions \
+        storage/framework/views \
+        storage/logs \
+        bootstrap/cache
+
+    if [ "$(id -u)" = "0" ]; then
+        # Top-level only: allows creating vendor/ when the mount is root-owned
+        chown www-data:www-data /var/www/html 2>/dev/null || true
+        chown -R www-data:www-data storage bootstrap/cache 2>/dev/null || true
+        git config --global --add safe.directory /var/www/html 2>/dev/null || true
+    fi
+}
+
+prepare_bind_mount
+
+echo "👉 init-setup: composer install..."
+# Run as root when needed so a root-owned bind mount cannot block vendor/
+# creation, then hand writable paths to www-data for PHP-FPM.
+composer install --no-interaction
+
+echo "👉 init-setup: migrate..."
+php artisan migrate --step --force
+
+echo "👉 init-setup: artisan dev --init..."
+php artisan dev --init
+
+if [ "$(id -u)" = "0" ]; then
+    chown -R www-data:www-data vendor storage bootstrap/cache 2>/dev/null || true
+fi
+
+echo "👉 init-setup: done"