[SandObserver]

Summary

• Add docker-compose.dev.yml: builds the working tree and runs docker compose watch. ui/ syncs without a restart; api/src, ui/widgets and the ui/js modules copied to /app/ui/js sync and restart; the Dockerfile, nginx, supervisord and entrypoint rebuild.
• Bind the dev port to 127.0.0.1:8701 only, keep the production capability, memory, CPU and pid limits, and rewrite the year-long Cache-Control lines in dashboard.conf to no-cache at container start.
• Keep dev data in .dev/, excluded in .gitignore and .dockerignore.
• Add test/repo/compose-dev.test.js pinning the loopback bind, the shared limits, the absence of guard-disabling variables, host networking, an env file and the Docker socket, the .dev/ exclusions, a watch rule for every shared module in the Dockerfile, the cache rewrite to no-cache matching every long-lived cache line, and no watched path excluded by .dockerignore.
• Remove Dockerfile from .dockerignore so the Dockerfile watch rule fires.
• Document the dev loop in CONTRIBUTING.md.

Testing
All green. Added 7 tests for the dev Compose file.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.