Add a local Schulcloud instance modelled on the live target

A Docker Compose stack that runs the deployed images
(quay.io/schulcloudverbund/*, thr theme, tag 33.40 — the versions
schulcloud-thueringen.de reports) rather than a rebuild of main, so what we
develop against is the deployed artefact. It exists to produce the states we
can otherwise only observe read-only: log in as the teacher, grade, then read
it back the way the MCP server does.

Faithful where it matters and honest where it isn't:

- Feature flags in env/api.env are a replay of GET /api/v3/config/public from
  the live instance, not a hand-picked set; instance identity mirrors the thr
  group_vars from dof_app_deploy.
- The proxy is generated from the deployment's own ingress table
  (scripts/gen-proxy-conf.py) so the legacy-client / SPA / API path split
  matches production; getting it wrong tests a different application.
- Valkey runs in `single` mode so the JWT whitelist expires sessions the way
  production does, rather than the in-memory shortcut that hides it.
- No external OAuth / Schulportal login (excluded by request and not
  reproducible locally), no BigBlueButton; each divergence is marked at the
  line it affects. Everything binds to 127.0.0.1 and uses the upstream dev
  credentials, which are public.

Profiles keep the heavy pieces opt-in: `tools` adds Etherpad/H5P/tldraw/
Collabora, `av` adds ClamAV, `preview` adds thumbnailing.

seed.sh loads the upstream demo school (the same call the deployment's init job
makes) and registers MinIO as the legacy storage provider, which has no seed
data on purpose. The demo data already contains the grading states that are
hard to obtain from the real account — a feedback-only grade and a 100% one —
which is what surfaced the past-due submitted-text scrape gap.

One config finding baked in: file-storage and h5p validate a token's
issuer/audience against JWT_DOMAIN (default "localhost"), while the API stamps
SC_DOMAIN; without keeping them equal, the homework page's file lookups 401.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

local-instance/scripts/minio-init.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Creates the buckets each service expects. MinIO does not create them on
+# demand: file-storage reports a generic 500 on upload if its bucket is
+# missing, and the h5p library job fails halfway through.
+set -eu
+
+mc alias set local http://minio:9000 miniouser miniouser
+
+for bucket in \
+	schulcloud `           # files-storage (the /api/v3/file API)` \
+	h5p-content-bucket `   # h5p-editor content` \
+	h5p-library-bucket `   # h5p content types` \
+	ydocs `                # tldraw whiteboard documents` \
+	fwu-content            # FWU media, unused but cheap to create
+do
+	mc mb --ignore-existing "local/$bucket"
+done
+
+mc ls local