chore(dev): DDEV setup so the test suite actually runs

Mirrors aqua-iq's pattern but adapted for pictureFrame's stack:
postgres 16, php 8.4, node 22, imagick + pcov via apt extras,
Mercure hub at https://pictureframe.ddev.site/.well-known/mercure,
and four custom commands — `ddev tests`, `ddev coverage`,
`ddev frontend` (vite HMR), `ddev worker`.

Also restores dev deps (DAMA, Doctrine fixtures, symfony/uid) that
got dropped during earlier composer reshuffles, and adds a separate
`db_test` connection in .env.test so DAMA's transactional isolation
doesn't share state with whatever dev is mid-experiment with.

Two test fixes the new env exposed:
  - RotationServiceTest::test_prioritize_never_shown_falls_through_when_all_shown
    needed uniquenessWindow=2 so the recent-window filter wipes the
    set and the fallback restores the full pool — otherwise window=1
    excluded the most-recently-served image and the assertion drifted.
  - DeviceImageControllerTest::test_locked_image_served_without_rotation_advance
    was asserting currentImage stays null on a lock poll, but the
    controller intentionally sets currentImage on the lock path so
    Home reflects the live frame state. Now asserts both the
    currentImage update AND that no DeviceImageHistory row was
    written (the actual rotation-bypass guarantee).

Backend coverage (full suite via `ddev coverage`): 89.08% lines /
92.24% methods / 74.36% classes — the first real number we've had.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.ddev/config.yaml

@@ -3,13 +3,31 @@ type: symfony
 docroot: public
 php_version: "8.4"
 webserver_type: nginx-fpm
+xdebug_enabled: false
+additional_hostnames: []
+additional_fqdns: []
 database:
-  type: postgres
-  version: "16"
+    type: postgres
+    version: "16"
+use_dns_when_possible: true
 composer_version: "2"
+nodejs_version: "22"
+# imagick + pcov match the prod php image so dev/test parity is real.
+# Installed via apt (deb.sury.org) — DDEV's web image doesn't ship pecl on PATH,
+# so the extension-package route is more reliable across arch.
 webimage_extra_packages:
-  - php8.4-imagick
-  - php8.4-pcov
+    - php8.4-imagick
+    - php8.4-pcov
+web_environment:
+    - APP_ENV=dev
+    # DDEV's postgres service is reachable as host `db` from the web container.
+    - DATABASE_URL=postgresql://db:db@db:5432/db?serverVersion=16&charset=utf8
+    - MERCURE_URL=http://mercure/.well-known/mercure
+    - MERCURE_PUBLIC_URL=https://pictureframe.ddev.site/.well-known/mercure
+    - MERCURE_JWT_SECRET=!ChangeThisMercureHubJWTSecretKey!
 hooks:
-  post-start:
-    - exec: composer install --no-interaction 2>/dev/null || true
+    post-start:
+        # Keep dev deps in sync with the lock file, and warm node_modules so
+        # `ddev exec cd frontend && npm test` works on a fresh clone.
+        - exec: "composer install --no-interaction"
+        - exec: "[ -d frontend/node_modules ] || (cd frontend && npm install)"