chore: Adopt Make as canonical task runner with working host + stage workflows

[Nickatak]

chore: Adopt Make as canonical task runner with working host + stage workflows

Branch: chore/makefile-rewrite stacked on docs/public-adrs (#746), which is stacked on the pattern PR chain (#739-#745), which is stacked on the modernization chain (#734-#738). Retarget chain when each parent lands.

This PR makes the repo-root Makefile the canonical surface for common dev commands (per ADR-0014). The previous Makefile was broken in several ways - referenced removed services, ran tests against the wrong app name, named db-shell for what was actually Django's REPL. This rewrite establishes namespaced targets, fixes the recipes so they actually run end-to-end on a clean host, adds a host-process workflow plus a local stage smoke test, and switches make lint to use a venv-pinned pre-commit instead of whatever's on the host.

Summary

9 files changed, ~520 lines net (the bulk is poetry.lock reflowing for the new pre-commit dev dep). Two commits.

#	Subject
1	chore: Adopt Make as canonical task runner with working host + stage workflows
2	docs: Add ADR-0014 and rewrite quickstart-guide for Make workflow

Surfaces (commit 1)

Targets are namespaced by the surface they touch:

• local-* - host-process workflow for rapid iteration. local-install cleans node_modules / .venv first, uses npm ci to keep the lockfile alpine-compatible, and bootstraps the venv with python3.13 explicitly so poetry doesn't fall back to a missing bare python binary. BACKEND_RUN sources dev/dev.env and overrides SQL_HOST=localhost so host Django reaches the published pgdb port instead of the docker-DNS pgdb name.
• docker-* - dev-stack lifecycle (up / down / logs / watch).
• db-* - schema + data ops, with read-based yes confirmation prompts on destructive paths (db-reset, db-reset-hard).
• stage-* - production-shaped local simulation. stage-smoke is the primary tool: builds, ups, polls django (/api/healthcheck/) and next (/), tears down, exits 0/1. stage-up / stage-down exist for debugging when smoke fails. All three fail fast with an actionable error if stage/stage.env is missing. Real stage deploy still lives in HfLA's incubator repo; stage-smoke only validates that the images and compose work locally.
• lint / install-hooks - pre-commit is now a backend dev dep (pyproject.toml), so make lint invokes the venv's pre-commit 4.6.0 instead of whatever system pre-commit happens to be installed. Resolves a stale-system-pre-commit issue surfaced during testing (Ubuntu's /usr/bin/pre-commit 2.17.0 rejects the pre-commit stage name that the config uses).
• local-check-prereqs verifies node 24 / python3.13 / poetry / docker and exits non-zero on any miss. Surfaces missing prerequisites before deeper recipes fail with confusing errors.

make help is .DEFAULT_GOAL; lists everything with one-line summaries.

Companion changes (commit 1)

• dev/dev.env.example swept of dead vars (MODE, DEVTOOL, ENVIRON, DATABASE - all Webpack/Vite-era or Django scaffolding leftovers with zero reads). Adds BACKEND_INTERNAL_URL=http://django:8000 so next.config.ts can drive /api/* and /admin/* rewrites in dev. SQL_PASSWORD placeholder typo (<same as POSTGRES_POSTGRES_PASSWORD>) fixed.
• .pre-commit-config.yaml: default_language_version.node switched from "24" to system. nodeenv's v24 prebuilt download URL doesn't resolve; we already require Node 24 on the host as a prereq, so reusing it is the right call.
• backend/pyproject.toml adds pre-commit = "^4.4.0" as a dev dep; backend/poetry.lock refreshed.
• backend/.python-version deleted (stale 3.12.4 pin from the pre-rewrite era; project now requires ^3.13).
• local-clean no longer swallows permission errors - replaced the silent find ... 2>/dev/null || true chain with rm -rf so root-owned residue from prior sessions surfaces clearly.

Docs (commit 2)

ADR-0014 records the decision: namespace conventions, confirmation-prompt pattern, make lint delegating to pre-commit (one source of truth across local and CI), variables at top, help as default goal. Standard ADR shape; index entry under "Process" in docs/decisions/README.md.

quickstart-guide.md rewritten around make targets rather than raw docker compose ... invocations. New sections: Database operations, Running tests, Stage smoke testing, Shell access, Local utilities. Lint section leads with make lint and keeps the individual-tool fallback for iterating on a single tool.

Also fixes a stale 404 envelope example in the quickstart: was the pre-error-envelope shape (with status_code / message keys); now matches the actual civic_exception_handler shape per ADR-0013.

Test plan

• make help renders the categorized command reference.
• make local-check-prereqs reports all green when the host has node 24, python3.13, poetry, docker.
• make local-install (frontend + backend) succeeds end-to-end. npm ci keeps package-lock.json byte-identical to committed.
• make docker-up builds and starts all three containers cleanly.
• make db-up / db-migrate / db-makemigrations / db-grant-test-db-perms all green.
• make local-makemigrations / local-test-backend (10 tests OK) / local-test-frontend (11 pass / 3 skipped) / local-test (parent) all green.
• make lint runs the venv's pre-commit 4.6.0; all 12 hooks pass.
• make stage-smoke builds stage images, brings up the stack, both probes return green, auto-tears down, exits 0. ~2 minutes from cold cache.
• make db-reset / db-reset-hard confirm prompts work; volume destruction verified.
• make local-clean / local-kill-ports / docker-down clean up cleanly.

Skipped (long-running or interactive; verified by inspection): local-run-frontend, local-run-backend, local-superuser, docker-logs, docker-watch, docker-shell-*.

Follow-ups (not blocking)

• stage/stage.env.example carries the same dead ENVIRON and DATABASE vars dev.env.example did; cleanup deferred (tracked locally).
• Anyone running pre-commit install against the host (system) pre-commit may want to upgrade out of Ubuntu's apt 2.17.0; make install-hooks now uses the venv binary so the system version is no longer load-bearing for the project's hooks.
• If a "fast subset" lint target later (e.g. ruff check + eslint, no type checking) becomes useful, it's an additive make lint-fast on top of this baseline.

[RSkuma]

Looks good to me