chore(dev): correct container env in docker-compose.dev.yml

Running in a container picked up host-oriented values from .env via env_file:
- MEDIA_PATH pointed at a host path that doesn't exist in the container, so every
  upload 500'd with EACCES; point it at the /media volume mount.
- ADMIN_PASSWORD_HASH lost its $-delimited bcrypt segments to Compose interpolation
  (admin login 401'd); re-supply it with $$ escaping.
- COMMENTS_ENABLED=false to smoke-test the comment kill-switch.

NOTE: production compose + .env carry the same MEDIA_PATH / admin-hash pitfalls.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.dev.yml

@@ -11,3 +11,31 @@ services:
     # is tolerated (warned) rather than rejected.
     environment:
       APP_ENV: development
+      # `.env` sets DATABASE_URL to @localhost for the run-backend-natively workflow
+      # (the db port is published above for that). When the app runs IN a container,
+      # localhost is the app itself — point it at the `db` service instead. Creds are
+      # interpolated from .env so nothing is hardcoded.
+      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
+      # `.env` sets MEDIA_PATH to a HOST path (/home/fabi/EventSnap/media) for the
+      # run-backend-natively workflow. In a container that path doesn't exist and the
+      # app user can't create it from `/`, so every upload 500s with EACCES. The media
+      # volume is mounted at /media (see docker-compose.yml) — point the app there.
+      MEDIA_PATH: /media
+      # Recent Docker Compose interpolates env_file values, so the `$` segments of the
+      # bcrypt ADMIN_PASSWORD_HASH in .env get eaten (the salt reads as an unset var) —
+      # every admin login then 401s. Re-supply it here with `$` doubled to `$$` so Compose
+      # passes the literal hash. NOTE: production (docker-compose.yml + .env) has the SAME
+      # bug — escape the hash as `$$` in .env, or set it via `environment:` there too.
+      ADMIN_PASSWORD_HASH: "$$2b$$12$$PAteqCNpsbm6d0HTJcywfOaUovjAU.iNVlsL7EDYaRC/z4P/xv7ye"
+      # Smoke-testing the comment kill-switch: boot-time flag, so it needs a restart
+      # (not an admin-UI toggle). Backend rejects new comments (403) and the frontend
+      # hides the whole comment UI. Flip back to true (or drop this line) to restore.
+      COMMENTS_ENABLED: "false"
+
+  caddy:
+    # The prod caddy service has no env_file, so the Caddyfile's `{$DOMAIN}` expands
+    # to empty and the site block collapses into a malformed global block. Supply it
+    # for local dev (from .env → localhost, which Caddy serves with a local self-signed
+    # cert). NOTE: the prod compose likely needs DOMAIN wired to caddy too.
+    environment:
+      DOMAIN: ${DOMAIN}