Add Docker-routed dev tooling, smoke test, example config, and docs

Route every compile/vet/test path through a digest-pinned golang:1.26
builder container (dev.sh + Makefile) so the host never runs a Go
toolchain. Add an end-to-end smoke that serves keyproxy in a container
with a throwaway config and drives 401/200/404/400/501/405 paths with
python urllib, asserting the server log is redacted. Ship a commented
keyproxy.toml.example (the real config stays gitignored along with any
*.env tripwire) and rewrite the README as the full quickstart, config,
HTTP, CLI, and redaction reference.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

smoke/smoke.sh

@@ -0,0 +1,94 @@
+#!/bin/sh
+# keyproxy end-to-end smoke: builds in the digest-pinned builder, starts
+# `keyproxy serve` in a container on host port 8082 with a throwaway
+# config + throwaway 0600 env files, drives it from the host with python
+# urllib (curl is banned on the host by policy), checks the 401/200/404/
+# 400/501/502 paths AND that the server log is redacted (no material,
+# every ref masked as <ref>=***), then tears everything down.
+set -e
+cd "$(dirname "$0")/.."
+
+IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm
+NAME="keyproxy-smoke"
+PORT="${PORT:-8082}"
+
+./dev.sh build
+
+rm -rf .smoke
+mkdir -p .smoke
+chmod 0700 .smoke
+
+# Throwaway material (smoke values only; never real secrets).
+cat > .smoke/keyproxy.env <<'EOF'
+KEYPROXY_TOKEN=smoke-bearer-token-1111
+EOF
+cat > .smoke/creds.env <<'EOF'
+API_KEY=smoke-secret-material-2222
+OTHER=smoke-other-3333
+EOF
+chmod 0600 .smoke/keyproxy.env .smoke/creds.env
+
+# In-container bind is all-interfaces ONLY because docker -p publishing
+# is the boundary here; the host default (and example config) stays
+# loopback.
+cat > .smoke/keyproxy.toml <<EOF
+listen = ":8082"
+
+[auth]
+token_ref = "mpk-keyproxy-self"
+
+[refs."mpk-keyproxy-self"]
+backend = "file"
+source = "/h/.smoke/keyproxy.env"
+key = "KEYPROXY_TOKEN"
+
+[refs."mpk-smoke"]
+backend = "file"
+source = "/h/.smoke/creds.env"
+key = "API_KEY"
+
+[refs."mpk-smoke-env"]
+backend = "env"
+source = "KEYPROXY_SMOKE_ENV"
+
+[refs."mpk-smoke-bw"]
+backend = "bitwarden"
+source = "sm://p/smoke"
+key = "API_KEY"
+
+[refs."mpk-smoke-vault"]
+backend = "vault"
+source = "secret/data/smoke"
+key = "API_KEY"
+EOF
+
+docker rm -f "$NAME" >/dev/null 2>&1 || true
+docker run -d --name "$NAME" -p "$PORT:8082" \
+    -v "$PWD:/h" -w /h -u "$(id -u):$(id -g)" -e HOME=/tmp \
+    -e KEYPROXY_SMOKE_ENV=smoke-env-material-4444 \
+    "$IMAGE" /h/bin/keyproxy serve -config /h/.smoke/keyproxy.toml
+
+cleanup() {
+    docker rm -f "$NAME" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+echo "--- probing http://127.0.0.1:$PORT (python urllib; curl banned on host) ---"
+BASE_URL="http://127.0.0.1:$PORT" KEYPROXY_TOKEN="smoke-bearer-token-1111" \
+    python3 smoke/probe.py
+probe_rc=$?
+
+echo "--- server log (redaction check) ---"
+LOG="$(docker logs "$NAME" 2>&1)"
+echo "$LOG"
+
+if echo "$LOG" | grep -q 'smoke-secret-material-2222\|smoke-env-material-4444\|smoke-bearer-token-1111'; then
+    echo "FAIL: server log contains material"
+    exit 1
+fi
+if ! echo "$LOG" | grep -q 'ref=mpk-smoke=\*\*\*'; then
+    echo "FAIL: server log does not mask refs as <ref>=***"
+    exit 1
+fi
+
+exit "$probe_rc"