Add Docker-routed dev tooling, smoke test, example config, and docs

Route every compile/vet/test path through a digest-pinned golang:1.26
builder container (dev.sh + Makefile) so the host never runs a Go
toolchain. Add an end-to-end smoke that serves keyproxy in a container
with a throwaway config and drives 401/200/404/400/501/405 paths with
python urllib, asserting the server log is redacted. Ship a commented
keyproxy.toml.example (the real config stays gitignored along with any
*.env tripwire) and rewrite the README as the full quickstart, config,
HTTP, CLI, and redaction reference.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

Makefile

@@ -0,0 +1,19 @@
+# Makefile: thin front door over dev.sh so `make build/vet/test/check`
+# route through the digest-pinned Docker builder (ALL dev work in
+# Docker — the host never runs a Go toolchain).
+.PHONY: build vet test check smoke
+
+build:
+	@./dev.sh build
+
+vet:
+	@./dev.sh vet
+
+test:
+	@./dev.sh test
+
+check:
+	@./dev.sh check
+
+smoke:
+	@./dev.sh smoke