feat: glitchtip docker stack + local dev integration

WS-7 PR-1 — bring up self-hosted GlitchTip alongside the existing
dev stack. One compose file is portable to the production monitoring
host (RFC-WS-7 §3.1).

- docker-compose.glitchtip.yml: web/worker/postgres/redis pinned, web
  bound to 127.0.0.1:8200, internal network for postgres + valkey.
- docker/glitchtip/.env.example: documented dev defaults + production
  checklist; .env itself ignored.
- Makefile: services / services-stop merge both compose files; new
  services-glitchtip-status tail target.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker/glitchtip/.env.example

@@ -0,0 +1,62 @@
+# GlitchTip — environment configuration
+#
+# Local development: cp .env.example .env  (the dev defaults below are
+# functional out of the box — no edits required for `make services`).
+#
+# ⚠️  PRODUCTION CHECKLIST (deploying to monitoring.hausdesign.nl):
+#     - Regenerate SECRET_KEY with:
+#         python -c "import secrets; print(secrets.token_urlsafe(50))"
+#     - Set POSTGRES_PASSWORD to a strong random value from the 1Password
+#       vault. The password embedded in DATABASE_URL MUST match.
+#     - Set EMAIL_URL to the real SMTP relay (smtp+tls://USER:PASS@HOST:PORT).
+#     - Set GLITCHTIP_DOMAIN=https://monitoring.hausdesign.nl (HTTPS, no
+#       trailing slash).
+#     - Set DEFAULT_FROM_EMAIL to a real sender on the hausdesign.nl domain.
+#     - Never commit the production .env. Keep it on the host only.
+
+# === GlitchTip core ===
+# Generate a real value for production: see header for the python one-liner.
+SECRET_KEY=dev-only-not-for-production-use
+
+# Postgres connection. Password MUST match POSTGRES_PASSWORD below.
+DATABASE_URL=postgres://postgres:devsecret@glitchtip-postgres:5432/glitchtip
+
+# Valkey/Redis connection (Celery broker + result backend).
+REDIS_URL=redis://glitchtip-redis:6379/0
+
+# Internal listen port for the GlitchTip web container.
+PORT=8000
+
+# Public-facing URL of the GlitchTip web UI.
+# Dev:  http://localhost:8200
+# Prod: https://monitoring.hausdesign.nl
+GLITCHTIP_DOMAIN=http://localhost:8200
+
+# Default sender address for outbound mail (alerts, password resets, …).
+# Dev:  glitchtip@localhost.dev
+# Prod: glitchtip@hausdesign.nl
+DEFAULT_FROM_EMAIL=glitchtip@localhost.dev
+
+# Outbound SMTP relay.
+# Dev:  smtp://bm_mailpit:1025  (alerts visible at http://localhost:8025)
+# Prod: smtp+tls://USER:PASSWORD@HOST:PORT
+EMAIL_URL=smtp://bm_mailpit:1025
+
+# === Registration (locked down — same in dev and prod) ===
+# Bert is the only user; first admin is created via:
+#   docker exec -it glitchtip-web ./manage.py createsuperuser
+ENABLE_USER_REGISTRATION=False
+ENABLE_OPEN_USER_REGISTRATION=False
+
+# === Worker tuning ===
+# Celery autoscale: min,max workers. 1,3 is the production default.
+CELERY_WORKER_AUTOSCALE=1,3
+
+# Recycle each worker after N tasks to bound memory growth.
+CELERY_WORKER_MAX_TASKS_PER_CHILD=10000
+
+# === Postgres (consumed only by the glitchtip-postgres service) ===
+POSTGRES_USER=postgres
+# MUST match the password embedded in DATABASE_URL above.
+POSTGRES_PASSWORD=devsecret
+POSTGRES_DB=glitchtip