feat(devenv): make the Gotenberg compose stacks work out of the box (#699)

Choosing Gotenberg in ./devenv started the `pdf` sidecar and configured
nothing else, so the app still defaulted to dompdf. Pointing it at the
sidecar by hand then hit the SSRF guard, because `pdf` resolves to a
private address on the compose network — the failure #691 fixed, hit
from inside our own dev environment.

The three gotenberg compose files now set PDF_DRIVER, GOTENBERG_HOST and
GOTENBERG_ALLOWED_PRIVATE_HOST on php-fpm, so the stack renders through
the sidecar with no .env editing at all. The serversideup pool config
already sets `clear_env = no`, so these reach the workers; verified by
generating a real invoice PDF end to end (24967 bytes, %PDF-1.4).

Setting the environment in compose rather than writing to .env keeps the
devenv script from mutating a developer's own file — it does not touch
.env today, and the values belong to the compose file the developer
selected. Non-Docker setups have the same keys documented in .env.example.

devenv now prints what it configured, including that the compose file
exempts that one host from the SSRF guard, since a security control being
relaxed should not be silent.

docker/development/docker-compose.pgsql.gotenberg.yml

@@ -8,6 +8,13 @@ services:
         - UID=${USRID:-1000}
         - GID=${GRPID:-1000}
       target: development
+    environment:
+      # Gotenberg runs as the `pdf` service below, on this compose network, so
+      # its host resolves to a private address. PrivateNetworkGuard rejects those
+      # by default — naming the exact host is what exempts it, and only it.
+      - PDF_DRIVER=gotenberg
+      - GOTENBERG_HOST=http://pdf:3000
+      - GOTENBERG_ALLOWED_PRIVATE_HOST=http://pdf:3000
     volumes:
       - ../../:/var/www/html
     networks: