feat(dev): add one-command local Stalwart test server + workflow docs

Add docker-compose.yml: a disposable Stalwart instance with a fixed dev
admin account (STALWART_RECOVERY_ADMIN), matching the credentials
scripts/dev-token.ps1 already expected. Wired up via new npm scripts
(dev:server, dev:server:down, dev:server:logs).

scripts/dev-token.ps1 was previously untracked (the whole scripts/
directory was gitignored) even though it's part of the documented dev
workflow — un-ignored it, and added scripts/dev-token.sh, a POSIX
equivalent for non-Windows shells and AI agents without PowerShell.

New DEVELOPMENT.md documents the full loop end-to-end (start server,
get a token, run the dev server, verify), written so it's actionable by
both humans and AI coding agents without needing a browser. Linked from
AGENTS.md (Commands) and README.md (Getting started).

Verified manually: docker compose up brings the server to a healthy
state, /api/auth + /auth/token issue a working bearer token, and
/jmap/session returns 200 with it end-to-end.

AGENTS.md

@@ -8,12 +8,16 @@ Community fork of [stalwartlabs/webui](https://github.com/stalwartlabs/webui), a
 
 ## Commands
 
-- `npm run dev` - Dev server
+- `npm run dev:server` - Start a local disposable Stalwart test server (Docker); `npm run dev:server:down` to stop it
+- `bash scripts/dev-token.sh` (or `pwsh ./scripts/dev-token.ps1` on Windows) - Get a dev access token from that server
+- `npm run dev` - Dev server (proxies `/api` and `/jmap` to the test server)
 - `npm run typecheck` - `tsc --noEmit`
 - `npm run lint` - ESLint
 - `npm run test` - Vitest (`npm run test:watch` to watch)
 - `npm run build` - `tsc -b && vite build`
 
+Full local dev workflow, including how to run it end-to-end without a browser: [DEVELOPMENT.md](DEVELOPMENT.md).
+
 ## Rules
 
 The detailed rules live in `.agents/rules/`. Read the relevant file before acting: