Automate local development setup with verified TLS

[Jan-Pilar]

A fresh checkout requires manual .env setup and exits when Boat or Telegram credentials are missing. sh dev.sh can also fail while sourcing .env, and HTTPS requests can fail when Python's default CA file is absent. This change automates local setup, preserves generated secrets, and configures verified HTTPS trust before starting development services.

Changes

• Re-enter Bash when invoked through a different sh, resolve paths from the script location, and parse dotenv values as data with quoted shell exports.
• Check required tools, Docker Compose, and Docker access before preparing configuration.
• Create a private backend/.env from the example, install dependencies with uv, and generate missing Fernet and webhook secrets. Preserve existing secrets and rotation keys; stop on an invalid existing encryption key.
• Allow API/web startup without a Boat key and skip the Telegram bot when its token is missing. Preserve explicit skip flags and existing frontend configuration.
• Return actionable HTTP 503 responses for sandbox operations without Boat credentials, before creating an SDK client or making network requests.
• Detect a usable OpenSSL/system CA bundle, falling back to certifi. Validate explicit SSL_CERT_FILE settings and pass them to the Boat SDK, including settings loaded from backend/.env.
• When Boat is configured, check its TLS handshake before launching services. This sends no API credentials and creates no sandbox. Report certificate failures with instructions for configuring an administrator-provided CA bundle; certificate and hostname verification remain enabled.
• Report missing or unhealthy Postgres containers before running migrations and application processes.
• Document automatic setup and add startup tests plus Linux/macOS GitHub Actions.

Validation

• 27 automated tests passed with the locked backend dependencies, covering initial/repeated startup, Bash/sh invocation, inherited configuration, secret preservation, dotenv quoting, missing tools, skip flags, startup failures, CA selection, TLS preflight failures, and both sandbox creation endpoints without credentials.
• A local HTTPS regression test rejects an untrusted certificate, succeeds with the selected CA, and rejects an incorrect hostname. A backend integration test confirms that a CA set in .env reaches Boat's urllib3 transport with verification enabled.
• Backend smoke test passed with generated configuration and an empty Boat key: application import, encryption round-trip, health endpoint, and OpenAPI (HTTP 200).
• Bash/sh syntax checks, workflow YAML parsing, and git diff --check passed.

Startup tests simulate Docker, uv, and npm; TLS tests use a local server. The backend smoke test does not connect to PostgreSQL or external services. A separate read-only live check reproduced the reported TLS failure and identified a Fortinet-issued certificate not trusted by either available CA bundle. Successful Boat connections on that network require its administrator-provided CA; the application does not disable verification or automatically trust the intercepted certificate.

Sandbox creation, Claude login, and task execution still require real Boat credentials; permission callbacks require a public backend URL.

[Anil-matcha]

This PR is currently blocked by merge conflicts after the launcher changes merged in #153 and #154. Please update this branch against current main and resolve the conflicts; then it can be reviewed again.