Add a runnable dev environment, and fix the pins that stopped it booting

The edge route had never been run. Adding a way to run it turned up that the
server could not start at all, for two independent dependency reasons that
typechecking could not see:

- `elysia: ^1.1.26` had resolved to 1.4.30, which calls `t.Module` - a TypeBox
  0.34 API - while this repo pinned TypeBox 0.33. `t.Module is not a function`.
- `drizzle-typebox: ^0.2.1` resolved to a version whose peers demand
  `drizzle-orm >= 0.36`, against the `^0.33.0` pinned here. Importing it threw
  `Export named 'getViewSelectedFields' not found`.

Both are caret ranges that drifted into combinations nobody chose. elysia,
@sinclair/typebox and the drizzle packages are now pinned tightly, TypeBox
forward to 0.34.52 (which satisfies Elysia and drizzle-typebox 0.1.1 alike),
and tests/dependency_identity.test.ts fails if the TypeBox version ever differs
between here and @continuum/ts-types - the skew that made every shared schema
invalid, with an error message pointing at Standard Schema instead.

Dropping to drizzle-typebox 0.1.1 widens `jsonb` in the generated validators,
so `metadata` needs an explicit object shape in validators.ts; the column is
declared `$type<Record<string, unknown>>()` and a validated body otherwise is
not assignable to `.values()`.

scripts/:

- `install-docker.sh` - one-time host setup, kept separate because it touches
  the machine rather than containers.
- `dev-env.sh up|down|reset|status|psql|schema|env` - Valkey + Postgres/pgvector.
  Uses docker-compose.yml when a daemon answers, and otherwise runs the same two
  services from apt. That fallback is not hypothetical: Docker cannot run in this
  sandbox at all. dockerd needs CAP_NET_ADMIN to build its bridge; with
  `--bridge=none --iptables=false` it starts but cannot unpack an image without
  CAP_SYS_ADMIN; with `--storage-driver=vfs` it still fails because registering a
  layer needs user namespaces, which are blocked outright. All three are
  host-level grants, so no script can work around them - hence a second path
  rather than a broken first one.
- `e2e-edge.sh` - the test the unit tests cannot be. Seeds a farm, claims its
  printers, mints an edge token, runs the real continuum-proxy, and asserts live
  telemetry reached Postgres and a command reached a printer. It only sends a fan
  speed, only to a printer reporting IDLE, and puts it back afterwards.
- `capture-gateway-frames.js` - records what a gateway really sends, for
  refreshing tests/fixtures/. Read-only unless FAN_TEST_PRINTER is set. The test
  comment referred to this before it existed.

Verified end to end, from a dropped and freshly migrated database: `h2c`
persisted as printing/RUNNING 22% layer 2/25 nozzle 230 bed 35 with 3 HMS
alerts, `p1p` as idle/IDLE, and `POST /printers/:id/commands` reached the P1P's
fan and came back ok:true. An unclaimed printer is refused 409
PRINTER_UNREACHABLE rather than guessed at.

Two things the e2e script got wrong first, both now fixed in it: it waited for
the first printer row instead of all of them, which silently tested only the v2
printer (a v1 Bambu reports one tick later); and `$!` after `( cd ... ) &` is
the subshell, so cleanup left an orphaned gateway reconnecting with a token for
a deleted farm and polluting the next run.

Note: `drizzle/` is gitignored, so the generated migration is not committed and
there is no migration history in the repo. Left as-is deliberately - that is a
workflow call, flagged in PLAN.md.

tests/dependency_identity.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, it } from "bun:test";
+import { dirname, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+
+/**
+ * Guards the one dependency mistake that broke the shared schemas, because
+ * nothing else catches it and the symptom points somewhere else entirely.
+ *
+ * `@continuum/ts-types` is linked from continuum-schemas and resolves its own
+ * dependencies from that repo's node_modules. It had TypeBox 0.32.37 while
+ * this backend had 0.33.24, and two *different* TypeBox versions mean two
+ * structurally incompatible `TSchema` types - so Elysia rejected every schema
+ * from there, with a message that pointed somewhere else entirely.
+ *
+ * The misleading part: Elysia's validator accepts
+ * `TSchema | StandardSchemaV1Like`, so when the TSchema branch failed
+ * TypeScript reported the *other* branch's failure, `'~standard' is missing`.
+ * That reads like Elysia wants a Standard Schema validator and TypeBox is the
+ * wrong tool, which is not true at all - Elysia is TypeBox-native (`t` is a
+ * TypeBox JavaScriptTypeBuilder, and the dist `require`s @sinclair/typebox at
+ * runtime without even declaring it as a dependency).
+ *
+ * Note what this does *not* check: that both resolve to the same file. A
+ * `file:` dependency keeps its own node_modules, so there are legitimately two
+ * copies on disk. Two copies of the *same version* are interchangeable here,
+ * because TypeBox's types are structural and its kind markers use
+ * `Symbol.for()`, which is global across copies. It is the version skew that
+ * breaks, not the duplication.
+ */
+
+/** The installed version of `name`, resolved as `from` would resolve it. */
+function installedVersion(name: string, from: string): string {
+  let dir = dirname(Bun.resolveSync(name, from));
+  // Walk up from the entry file to the package root - resolveSync returns e.g.
+  // build/esm/index.mjs, and package.json is not always an allowed export.
+  for (let i = 0; i < 10; i++) {
+    const candidate = join(dir, "package.json");
+    if (existsSync(candidate)) {
+      const pkg = JSON.parse(readFileSync(candidate, "utf8"));
+      if (pkg.name === name) return pkg.version;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(`could not find the installed package.json for ${name} from ${from}`);
+}
+
+describe("@sinclair/typebox version is identical everywhere", () => {
+  it("matches between this backend and @continuum/ts-types", () => {
+    const here = installedVersion("@sinclair/typebox", import.meta.dir);
+    const tsTypesDir = dirname(Bun.resolveSync("@continuum/ts-types", import.meta.dir));
+    const there = installedVersion("@sinclair/typebox", tsTypesDir);
+
+    expect(there).toBe(here);
+  });
+
+  it("is pinned exactly, not as a range", () => {
+    // A caret range is what let the two drift apart in the first place: this
+    // backend and ts-types each resolved their own newest match.
+    const pkg = JSON.parse(readFileSync(`${import.meta.dir}/../package.json`, "utf8"));
+    const pinned = pkg.dependencies["@sinclair/typebox"];
+    expect(pinned).not.toMatch(/^[\^~]/);
+    expect(installedVersion("@sinclair/typebox", import.meta.dir)).toBe(pinned);
+  });
+});

tests/edge_protocol.test.ts

@@ -14,8 +14,8 @@ import legacyCapture from "./fixtures/gateway_frames_legacy_nulls.json";
  * /ws/edge/v1 had silently drifted into completely different protocols
  * (different handshake, different telemetry shape, printer ids the gateway
  * could not know), and every hand-written example agreed with whichever side
- * wrote it. Re-capture with the script in the proxy's examples/ when the
- * protocol changes, rather than editing these by hand.
+ * wrote it. Re-capture with scripts/capture-gateway-frames.js when the protocol
+ * changes, rather than editing these by hand.
  */
 
 function check(schema: Parameters<typeof Value.Check>[0], value: unknown) {