initial switch to a devcontainer

.devcontainer/Dockerfile

@@ -0,0 +1,36 @@
+# Keep the Python version in sync with Dockerfile.dev
+FROM python:3.15-slim-trixie
+
+ARG USERNAME=dev
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
+# git + openssh-client: git over the host's forwarded SSH agent
+# gcc, libc-dev, libpq-dev: build psycopg2 from requirements.txt
+# postgresql-client, wait-for-it: scripts/db-setup.sh, scripts/psql.sh
+# curl, ca-certificates: Claude Code installer
+# vim: personal preferences
+RUN apt-get -y update && \
+    apt-get install --no-install-recommends -y \
+        git openssh-client make curl ca-certificates sudo \
+        gcc libc-dev libpq-dev \
+        postgresql-client wait-for-it \
+        vim && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --gid $USER_GID $USERNAME && \
+    useradd --uid $USER_UID --gid $USER_GID -m -s /bin/bash $USERNAME && \
+    echo "$USERNAME ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/$USERNAME && \
+    chmod 0440 /etc/sudoers.d/$USERNAME
+
+# Project venv, owned by the dev user so pip works without sudo
+ENV VIRTUAL_ENV=/opt/venv
+RUN python -m venv $VIRTUAL_ENV && chown -R $USERNAME:$USERNAME $VIRTUAL_ENV
+ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+
+USER $USERNAME
+
+# Claude Code (native installer, lands in ~/.local). The home dir is a volume
+# (see devcontainer.json); Claude then updates itself inside that volume.
+RUN curl -fsSL https://claude.ai/install.sh | bash
+ENV PATH="/home/$USERNAME/.local/bin:$PATH"

.devcontainer/compose.yml

@@ -0,0 +1,29 @@
+services:
+  dev:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    command: sleep infinity
+    volumes:
+      - ..:/workspaces/max:cached
+      - home:/home/dev
+    environment:
+      - PYTHONPATH=/workspaces/max
+      - FLASK_APP=max.app
+      - FLASK_ENV=development
+      - PGSQL_HOST=postgresql
+      - PGSQL_PORT=5432
+      - PGSQL_USER=max
+      - PGSQL_PASSWORD=max
+      - PGSQL_NAME=max
+    depends_on:
+      - postgresql
+  postgresql:
+    image: postgres:18.6
+    environment:
+      - POSTGRES_USER=max
+      - POSTGRES_PASSWORD=max
+      - POSTGRES_DB=max
+volumes:
+  home:
+    name: max-devcontainer-home

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
+      "version": "1.10.1",
+      "resolved": "ghcr.io/devcontainers/features/docker-outside-of-docker@sha256:698f5900fac471e046c6e9d4333fec88c0e8d952c713494fa0712dce80baeca0",
+      "integrity": "sha256:698f5900fac471e046c6e9d4333fec88c0e8d952c713494fa0712dce80baeca0"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -0,0 +1,22 @@
+{
+    "name": "max",
+    "dockerComposeFile": "compose.yml",
+    "service": "dev",
+    "workspaceFolder": "/workspaces/max",
+    "remoteUser": "dev",
+    "features": {
+        // moby=false: Moby packages are not available for Debian trixie, use Docker CE.
+        "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
+            "moby": false
+        }
+    },
+    // Bind mounts are resolved by the host's daemon, so they need host paths:
+    // use ${LOCAL_WORKSPACE_FOLDER} instead of paths inside this container.
+    "remoteEnv": {
+        "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}"
+    },
+    "postCreateCommand": "pip install -U pip && pip install -U -r requirements.txt -r requirements-dev.txt",
+    "forwardPorts": [
+        8000
+    ]
+}