Add Docker-routed dev tooling, smoke test, example config, and docs

Route every compile/vet/test path through a digest-pinned golang:1.26
builder container (dev.sh + Makefile) so the host never runs a Go
toolchain. Add an end-to-end smoke that serves keyproxy in a container
with a throwaway config and drives 401/200/404/400/501/405 paths with
python urllib, asserting the server log is redacted. Ship a commented
keyproxy.toml.example (the real config stays gitignored along with any
*.env tripwire) and rewrite the README as the full quickstart, config,
HTTP, CLI, and redaction reference.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

dev.sh

@@ -0,0 +1,54 @@
+#!/bin/sh
+# keyproxy dev wrapper. EVERY compile/vet/test path routes through the
+# digest-pinned Docker builder (DESIGN "ALL dev work in Docker" — big
+# rule); the host runs containers, never toolchains.
+#
+# Usage: ./dev.sh {build|vet|test|check|smoke|shell} [args...]
+#
+#   build    compile ./cmd/keyproxy into bin/keyproxy
+#   vet      go vet ./...
+#   test     go test ./...
+#   check    build + vet + test (the pre-push gate)
+#   smoke    end-to-end smoke: builds, starts `keyproxy serve` in a
+#            container on port 8082 with a throwaway config, drives it
+#            from the host with python urllib (curl is banned on host),
+#            shows 401/200/404/501 paths + redacted server log, tears
+#            everything down
+#   shell    interactive sh inside the builder
+set -e
+
+IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (bash present; alpine lacks it)
+
+run() {
+    docker run --rm -v "$PWD:/h" -w /h \
+        -u "$(id -u):$(id -g)" -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
+        "$IMAGE" "$@"
+}
+
+cmd=${1:-check}
+shift || true
+
+case "$cmd" in
+build)
+    run go build -o bin/keyproxy ./cmd/keyproxy
+    ;;
+vet)
+    run go vet ./...
+    ;;
+test)
+    run go test "$@" ./...
+    ;;
+check)
+    run sh -c 'go build -o bin/keyproxy ./cmd/keyproxy && go vet ./... && go test ./...'
+    ;;
+smoke)
+    ./smoke/smoke.sh
+    ;;
+shell)
+    run sh
+    ;;
+*)
+    echo "dev.sh: unknown command $cmd (build|vet|test|check|smoke|shell)" >&2
+    exit 1
+    ;;
+esac