[chore](dev): keep one Delve server across hot reloads

Replace Air's kill-and-rerun loop in the debug image with the pilot
persistent-delve supervisor: src/dev/dlv-watch.sh owns one headless
`dlv exec --multiclient --continue` server, rebuilds ./tmp/main on save and
restarts only the debug target through the tiny rpc2 client in
src/dev/dlv-restart. An attached VS Code session (and its breakpoints) now
survives saves instead of reconnecting after every reload.

The debug compose builds locally with `pull_policy: build` and without
`build.network: host`: compose cannot grant the network.host entitlement, so
a cold `up` previously failed with "additional privileges requested"; the
default bridge reaches the dev Gitea for module resolution.

docker-compose.debug.yaml

@@ -12,16 +12,25 @@ services:
     image: keepnote-debug
     container_name: keepnote-debug
 
-    # Build from our development Dockerfile
+    # Cold `docker compose -f docker-compose.debug.yaml up -d` builds this image
+    # directly — no pre-build step needed. Do NOT add `network: host` here:
+    # `docker compose up`/`build` cannot grant the `network.host` build
+    # entitlement (that needs `--allow=network.host`, which only `docker build`
+    # accepts), so a cold up would fail with "additional privileges requested".
+    # The default bridge reaches the dev Gitea (192.168.122.183), so
+    # Dockerfile.debug's GOPROXY resolves shared modules without host networking.
     build:
       context: .
       dockerfile: Dockerfile.debug
-      network: host
+
+    # `keepnote-debug` is a local-only tag: build it, never look it up in a
+    # registry (otherwise a cold `up` warns "pull access denied").
+    pull_policy: build
 
 
     # Expose ports: host:container
     ports:
-      - "8081:8080"     # Application port
+      - "8081:8080"     # The SINGLE port: API + SPA + /web/* (contract rev 9)
       # Delve: unique host port per service (auth-debug owns 2345), so the Go
       # attach launch config reaches Air's Delve listener (in-container 2345)
       # from the host without conflicts.