Build local product stack with Vault-managed secrets (#42)

docs/implementation.md

@@ -583,3 +583,55 @@ notification queue acceptance is not inbox delivery.
 
 Delivered in [PR #41](https://git.sendico.io/tech/sxchnge/pulls/41) against `main`.
 Branch `twofactor-40` is pushed. The PR is left open for review; no merge was performed.
+
+## Vault-backed local development (#42)
+
+Task [#42](https://git.sendico.io/tech/sxchnge/issues/42), branch `dev-env-42`.
+Primary module: dev environment; secondary scope: container packaging, root build
+commands, current-stable backend test images and repository container policy.
+
+- Added a dedicated `sxchnge-local` Compose project with persistent Vault, an
+  authenticated MongoDB replica set, NATS JetStream and build definitions for
+  notifications, BFF and Flutter/Nginx. Existing Sendico containers and volumes
+  remain independent.
+- `make build` resolves current stable releases and pins manifest digests in
+  ignored local state. Flutter is built from its stable source tag/commit. All
+  protobuf bindings and frontend output are generated within the build, never
+  committed. Root `AGENTS.md` now records the stable-container policy.
+- Bootstrap configures Vault KV/PKI/AppRole and `mongodb-database-plugin`, rotates
+  its Mongo manager credential and issues separate database roles for the BFF
+  and notifications. Vault Agent renews credentials and restarts child processes
+  on changes. Existing shared database/messaging paths remain intact.
+- Resend is the default. The user explicitly chose to provision its API key and
+  verified sender manually after bootstrap. `make up` leaves healthy infrastructure
+  running and intentionally exits nonzero before product startup while those
+  fields are empty. No placeholder credential or disabled driver was retained.
+- Frontend HTTPS and notification TLS use Vault PKI. The frontend proxies the BFF
+  at the same origin and builds with the existing real auth adapter and a seeded
+  public browser client. No UI or business service code changed.
+
+Validation: `make build` built all product images; `make test` and
+`make lint-backend` passed. Backend tests pull fresh Mongo/NATS stable images and
+use `-count=1` to prevent Go's test cache from hiding an image update.
+`make test-dev-infra` passed its five setup regression tests and live checks for
+AppRole restrictions, database issuance, cross-database denial, renewal and
+revocation. `docker compose ... config --quiet` and `git diff --check` passed.
+The initial image build exposed missing protobuf headers; installing
+`protobuf-dev` in the build stage fixed it.
+
+Additional live checks passed: a down/up cycle preserved a Mongo marker and Vault
+secrets and automatically unsealed Vault; changing/restoring the NATS token
+restarted the NATS child; a temporary 10-second/20-second BFF database role proved
+replacement credentials restart a healthy BFF (normal TTLs restored afterward).
+Temporary BFF/frontend containers served the web bundle and proxied BFF health
+successfully over HTTPS verified with the generated CA; those test containers
+were removed. The notifications image rendered its Agent configuration and exited
+with the expected missing email API key error. No real email was sent.
+
+The final `make build && make up` is expected to exit at the Resend provisioning
+check until the user populates `kv/email`. Full six-service readiness and a live
+Resend signup/login were not asserted without that credential. Vault, Mongo and
+NATS remain running. No optional security scan or merge was performed. See the
+[local development guide](local-development.md) for exact provisioning fields,
+certificate trust, restart behavior, local bootstrap-material handling and
+verification commands.