feat(demo): add complete TSYS developer support stack demo implementation

Add full demo environment with 13 services across 4 categories:
- Infrastructure: Homepage, Docker Socket Proxy, Pi-hole, Portainer
- Monitoring: InfluxDB, Grafana
- Documentation: Draw.io, Kroki
- Developer Tools: Atomic Tracker, ArchiveBox, Tube Archivist,
  Wakapi, MailHog, Atuin

Includes:
- Docker Compose templates with dynamic environment configuration
- Deployment orchestration scripts with user ID detection
- Comprehensive test suite (unit, integration, e2e)
- Pre-deployment validation with yamllint, shellcheck
- Full documentation (PRD, AGENTS, README)
- Service configurations for all components

All services configured for demo purposes with:
- Dynamic UID/GID mapping
- Docker socket proxy security
- Health checks and monitoring
- Service discovery via Homepage labels

Ports allocated 4000-4099 range with sequential assignment.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

demo/demo.env

@@ -0,0 +1,89 @@
+# TSYS Developer Support Stack - Demo Environment Configuration
+# Project Identification
+COMPOSE_PROJECT_NAME=tsysdevstack-supportstack-demo
+COMPOSE_NETWORK_NAME=tsysdevstack-supportstack-demo-network
+
+# Dynamic User Detection (to be auto-populated by scripts)
+DEMO_UID=1000
+DEMO_GID=1000
+DEMO_DOCKER_GID=996
+
+# Port Assignments (4000-4099 range)
+HOMEPAGE_PORT=4000
+DOCKER_SOCKET_PROXY_PORT=4005
+PIHOLE_PORT=4006
+PORTAINER_PORT=4007
+INFLUXDB_PORT=4008
+GRAFANA_PORT=4009
+DRAWIO_PORT=4010
+KROKI_PORT=4011
+ATOMIC_TRACKER_PORT=4012
+ARCHIVEBOX_PORT=4013
+TUBE_ARCHIVIST_PORT=4014
+WAKAPI_PORT=4015
+MAILHOG_PORT=4017
+ATUIN_PORT=4018
+
+# Demo Credentials (CLEARLY MARKED AS DEMO ONLY)
+DEMO_ADMIN_USER=admin
+DEMO_ADMIN_PASSWORD=demo_password
+DEMO_GRAFANA_ADMIN_PASSWORD=demo_password
+DEMO_PORTAINER_PASSWORD=demo_password
+
+# Network Configuration
+NETWORK_SUBNET=192.168.3.0/24
+NETWORK_GATEWAY=192.168.3.1
+
+# Resource Limits
+MEMORY_LIMIT=512m
+CPU_LIMIT=0.25
+
+# Health Check Timeouts
+HEALTH_CHECK_TIMEOUT=10s
+HEALTH_CHECK_INTERVAL=30s
+HEALTH_CHECK_RETRIES=3
+
+# Docker Socket Proxy Configuration
+DOCKER_SOCKET_PROXY_CONTAINERS=1
+DOCKER_SOCKET_PROXY_IMAGES=1
+DOCKER_SOCKET_PROXY_NETWORKS=1
+DOCKER_SOCKET_PROXY_VOLUMES=1
+DOCKER_SOCKET_PROXY_EXEC=0
+DOCKER_SOCKET_PROXY_PRIVILEGED=0
+DOCKER_SOCKET_PROXY_SERVICES=0
+DOCKER_SOCKET_PROXY_TASKS=0
+DOCKER_SOCKET_PROXY_SECRETS=0
+DOCKER_SOCKET_PROXY_CONFIGS=0
+DOCKER_SOCKET_PROXY_PLUGINS=0
+
+# InfluxDB Configuration
+INFLUXDB_ORG=tsysdemo
+INFLUXDB_BUCKET=demo_metrics
+INFLUXDB_ADMIN_USER=demo_admin
+INFLUXDB_ADMIN_PASSWORD=demo_password
+INFLUXDB_AUTH_TOKEN=demo_token_replace_in_production
+
+# Grafana Configuration
+GF_SECURITY_ADMIN_USER=admin
+GF_SECURITY_ADMIN_PASSWORD=demo_password
+GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource
+
+# Pi-hole Configuration
+PIHOLE_WEBPASSWORD=demo_password
+WEBTHEME=default-darker
+
+# ArchiveBox Configuration
+ARCHIVEBOX_SECRET_KEY=demo_secret_replace_in_production
+
+# Tube Archivist Configuration
+TA_HOST=tubearchivist
+TA_PORT=4014
+TA_DEBUG=false
+
+# Wakapi Configuration
+WAKAPI_PASSWORD_SALT=demo_salt_replace_in_production
+
+# Atuin Configuration
+ATUIN_HOST=atuin
+ATUIN_PORT=4018
+ATUIN_OPEN_REGISTRATION=true