Development and testing are Windows-only, so anything unverified elsewhere
needs to be written down or it gets assumed to work. Several of these have
already cost time once: PostgreSQL 18 moving its data directory silently
gives a carried-over compose file an empty volume, and a loopback-bound
Tomcat beat Docker's 0.0.0.0 publish for `localhost`, making every Keycloak
realm 404 while the container looked healthy.
The largest entry is the Avalonia WebView on Linux, which remains the
biggest risk in the plan and is why the terminal sits behind ITerminalHost.
Also records two things this milestone deliberately left undone -- no rate
limiting on the enrollment and sync write paths until M2, and /me not
touching last_seen_at_utc -- so neither reads later as an oversight.
