chore(HNT-2086): add local-dev config, compose, and docs

[mmiermans]

Goal

HNT-2086

Add the developer plumbing for running each service by hand against local infrastructure, and refresh the README with local setup prerequisites, per-service run instructions for the agent and both worker roles, and the package layout the split produced. The change is configuration and documentation only: an .env.example for each service that documents every variable it reads, a docker-compose.yml that brings up the Pub/Sub emulator and Redis, per-role dev scripts on the worker and agent, and README updates.

See docs/ARCHITECTURE.md in #14 for the worker flow the README summarizes.

Implementation decisions

Decision	Approach	Why
Keep the local compose stack separate from the test suite	docker-compose.yml brings up the Pub/Sub emulator and Redis for running a service by hand, and the tests do not use it because they start their own emulator via Testcontainers	A developer can exercise a service against local infrastructure without touching real GCP, while the test suite stays hermetic and self-contained rather than depending on a manually started stack.
The .env.example files carry no secrets and set only local defaults	Each example lists every variable the service reads, leaves secret fields blank, and directs the reader to copy it to a gitignored .env	Deployed values come from the Helm chart and Google Secret Manager. The MozCloud Configuration Reference mounts a default ExternalSecret from <env>-gke-app-secrets into every workload for secrets, while non-secret config comes from the chart configMap, so these examples exist for local runs only and must never hold a real key.
One dev script per worker role rather than a single dev	dev:article and dev:discovery set WORKER_ROLE and load .env through tsx --env-file-if-exists, with dev:discovery on a second port	The worker runs one role per process from a single image selected by WORKER_ROLE, so each role needs its own entry point; --env-file-if-exists loads .env when present without failing when it is absent, and the second port lets both roles run side by side.