Avoid dev port clashes and isolate docker compose per git worktree (#203)

* Avoid dev port clashes and isolate docker compose per git worktree

Default dev ports (80/443/5432) clash with other projects' compose
stacks. Remap them to 8080/8443/5433+ by default, and add `just init`
(auto-run by `just up`) to generate a per-worktree `.env.local` with a
unique COMPOSE_PROJECT_NAME, image tag, and free host ports, so
multiple worktrees can run `just up` concurrently without sharing
containers, volumes, images, or ports.

* Pin CI to port 80 for the HTTP reachability check; use 5430 as default Postgres dev port

CI runs in an isolated single-purpose runner with no port-clash concern,
so pin the HTTP reachability check back to port 80 explicitly rather
than changing the dev default.

Also move the default dev Postgres port range from 5433 to 5430, since
5433 clashes with other commonly used local projects.

* Fix Justfile init: propagate free_port failures and use portable hash

free_port exhaustion was swallowed inside a command substitution used as
an echo argument, silently writing empty ports to .env.local. shasum is
also not guaranteed on stripped-down Linux hosts.

README.md

@@ -25,8 +25,13 @@ just migrate   # Run pending database migrations
 just fixtures  # Load dev fixtures (truncates first)
 ```
 
-The app is available at **https://localhost** (self-signed cert — run
-`just trust-cert` on macOS to trust it).
+`just up` first runs `just init`, which generates a `.env.local` (gitignored)
+with a unique `COMPOSE_PROJECT_NAME`, image tag and free host ports for this
+checkout, so multiple worktrees/clones can run at the same time without their
+containers, volumes, images or ports colliding. Run `just ports` to see the
+ports assigned to the current checkout — the app is served at
+`https://localhost:<HTTPS_PORT>` (self-signed cert — run `just trust-cert` on
+macOS to trust it).
 
 ### Useful commands