dev-stack: add pict-rs container for image-hosting integration tests

The webapp and several lnbits extensions hit pict-rs for image
uploads (NIP-94/96 attachments, profile pictures, market listings,
etc.). Until now there was no local pict-rs for the dev stack to
talk to, so any client code touching that path either had to point
at a remote deployed instance or be tested without exercising the
upload flow.

Mirrors the deploy flake's services.pict-rs:
  - same port (6033) as modules/services/pict-rs.nix, so URLs
    written for prod just work locally with a host swap;
  - asonix/pictrs:0.5 (the upstream image; current stable major);
  - user "0:0" + ./data/pict-rs:/mnt to match the storage pattern
    other dev-stack containers use here.

Bohm's firewall already opens 6033 (see /etc/nixos/configuration.nix),
so LAN devices (phones for image-upload UX testing) can reach it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.dev.yml

@@ -1,20 +1,21 @@
 # Lightweight LNbits dev environment — FakeWallet, no Lightning nodes
 #
 # Usage:
-#   LNBITS_SRC=~/dev/lnbits/demo docker compose -f docker-compose.dev.yml up -d --build
+#   docker compose -f docker-compose.dev.yml up -d --build
 #   docker compose -f docker-compose.dev.yml logs -f lnbits
 #   docker compose -f docker-compose.dev.yml down
 #
-# LNBITS_SRC defaults to ~/dev/lnbits/demo. Override to use a different branch:
+# LNBITS_SRC defaults to ~/dev/lnbits/main. Override to use a different branch:
 #   LNBITS_SRC=~/dev/lnbits/dev docker compose -f docker-compose.dev.yml up -d --build
 #
-# LNbits:  http://localhost:5001
+# LNbits:   http://localhost:5001
-# Fava:    http://localhost:3333
+# Fava:     http://localhost:3333
+# pict-rs:  http://localhost:6033
 
 services:
   lnbits:
     hostname: lnbits
-    build: ${LNBITS_SRC:-/home/padreug/dev/lnbits/demo}
+    build: ${LNBITS_SRC:-/home/padreug/dev/lnbits/main}
     restart: on-failure
     user: "0:0"
     environment:
@@ -61,7 +62,7 @@ services:
       # Bind the lnbits package so host edits are picked up on container
       # restart without rebuilding the image. The venv at /app/.venv stays
       # baked in.
-      - ${LNBITS_SRC:-/home/padreug/dev/lnbits/demo}/lnbits:/app/lnbits
+      - ${LNBITS_SRC:-/home/padreug/dev/lnbits/main}/lnbits:/app/lnbits
       # Pre-start init: pin libra's fava_url to http://fava:5000.
       - ./lnbits-entrypoint.sh:/usr/local/bin/lnbits-entrypoint.sh:ro
     command: ["/usr/local/bin/lnbits-entrypoint.sh"]
@@ -74,3 +75,19 @@ services:
       - 3333:5000
     volumes:
       - ./data/fava:/bean
+
+  # Image hosting backend. Mirrors the deploy flake's services.pict-rs
+  # (modules/services/pict-rs.nix → port 6033). Webapp + extensions reach
+  # it on http://localhost:6033 from the host; in-network containers can
+  # use http://pict-rs:6033.
+  pict-rs:
+    image: asonix/pictrs:0.5
+    hostname: pict-rs
+    restart: on-failure
+    user: "0:0"
+    environment:
+      PICTRS__SERVER__ADDRESS: 0.0.0.0:6033
+    ports:
+      - 6033:6033
+    volumes:
+      - ./data/pict-rs:/mnt