Add Docker-routed dev tooling, smoke test, example config, and docs

Route every compile/vet/test path through a digest-pinned golang:1.26
builder container (dev.sh + Makefile) so the host never runs a Go
toolchain. Add an end-to-end smoke that serves keyproxy in a container
with a throwaway config and drives 401/200/404/400/501/405 paths with
python urllib, asserting the server log is redacted. Ship a commented
keyproxy.toml.example (the real config stays gitignored along with any
*.env tripwire) and rewrite the README as the full quickstart, config,
HTTP, CLI, and redaction reference.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

.gitignore

@@ -0,0 +1,7 @@
+# keyproxy.toml holds the ref map (paths + key names) — copy to
+# keyproxy.toml and fill in. keyproxy.toml itself is gitignored.
+# Any *.env file landing in this repo is ignored as a tripwire.
+keyproxy.toml
+*.env
+bin/
+.smoke/