Implement NetKingdom identity shell for coulomb.social (CSOC-WP-0002)

Django scaffold aligned with the business delivery lane: tenant-keyed
Member model without passwords, identity app as sole OIDC/session
boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and
tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP,
flex-auth, and packaging remain open.

docs/dev.md

@@ -0,0 +1,43 @@
+# Local development
+
+## Prerequisites
+
+- Python 3.12+
+- [`uv`](https://github.com/astral-sh/uv)
+
+## Setup
+
+```bash
+cd ~/coulomb-social
+uv sync
+uv run manage.py migrate
+uv run manage.py runserver 0.0.0.0:8008
+```
+
+Open http://127.0.0.1:8008/ — **Sign in** uses dev claims when
+`OIDC_ENABLED=false` (default) and `DEBUG=true`.
+
+## Tests
+
+```bash
+make test
+# or
+uv run pytest
+```
+
+## Environment
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `SECRET_KEY` | insecure dev default | Django secret |
+| `DATABASE_URL` | sqlite `./db.sqlite3` | DB |
+| `DEFAULT_TENANT_ID` | `binky` | Client #1 tenant key |
+| `OIDC_ENABLED` | `false` | Use real NetKingdom issuer |
+| `OIDC_ISSUER` | | Issuer base URL |
+| `OIDC_CLIENT_ID` / `OIDC_CLIENT_SECRET` | | OIDC client (secret from OpenBao in prod) |
+| `OIDC_REDIRECT_URI` | | e.g. `http://127.0.0.1:8008/auth/callback/` |
+| `USER_ENGINE_BASE_URL` | empty (stub) | user-engine HTTP |
+| `USER_ENGINE_APPLICATION_ID` | `coulomb-social` | App id in user-engine |
+| `FLEX_AUTH_BASE_URL` | empty (fail-closed except shell:view) | PDP |
+
+See `docs/adr/ADR-0001-netkingdom-identity.md` and `docs/identity/`.