[fix](alarm): label the debug compose for the data plane

Maestro resolves a service through the org.dcntrlized.service and org.dcntrlized.port labels; without them the single data plane answers unknown service for the dev stack, which is the only supported client path. Allow AUTH_SERVICE_URL to be overridden so the dev fleet can point at auth-debug.

docker-compose.debug.yaml

@@ -12,6 +12,15 @@ services:
     image: alarm:debug
     container_name: alarm-debug
 
+    # Discovery labels — exactly what Maestro's install path injects
+    # (`lib/containers/compose.go`): the service name and the port it listens on
+    # inside `dcntrlized_net`. Without them the single data plane answers
+    # `unknown service "alarm"` and a phone cannot reach this service through
+    # the only supported path, so the dev stack would be invisible to it.
+    labels:
+      org.dcntrlized.service: "alarm"
+      org.dcntrlized.port: "8080"
+
     # Cold `docker compose -f docker-compose.debug.yaml up -d` builds this image
     # directly — no pre-build step needed. Do NOT add `network: host` here:
     # `docker compose up`/`build` cannot grant the `network.host` build
@@ -57,8 +66,11 @@ services:
       # longer gates any listener — this listener is ALWAYS plaintext now.
       - DCNTRLIZED_DEBUG=true
 
-      # Shared auth service target (dcntrlized-auth on the dcntrlized network)
+      # Shared auth service target (dcntrlized-auth on the dcntrlized network).
-      - AUTH_SERVICE_URL=http://dcntrlized-auth:8080
+      # Overridable because the dev fleet runs the hub as `auth-debug`
+      # (`dcntrlized-auth/docker-compose.debug.yaml`) rather than under its
+      # production DNS name, and an alarm nobody can log in to is untestable.
+      - AUTH_SERVICE_URL=${AUTH_SERVICE_URL:-http://dcntrlized-auth:8080}
 
       # Service identity (inert in v1 — no /config edge — kept for fleet parity)
       - DCNTRLIZED_SERVICE_NAME=alarm