fix(devcontainer): reachable databases, Flutter 3.47.1, bubblewrap, live-tests profile (#1487, part 1)

[ZhuchkaTriplesix]

Summary

Section 1 of #1487 (contributor dev container defects). Sections 2 and 3 (headless L2 script, extension-author container) are not part of this PR, so it says Refs.

Defect	Change
Databases unreachable from the container (DooD: nothing listens on its loopback)	scripts/dev/devcontainer_start.sh joins the container to querya-dev_default and forwards 127.0.0.1:<port> to the services with socat (5432, 3306, 6379, 27017, 8123, 9000, and 3307 for mysql-live). Ports something already listens on are skipped; host networking keeps working. forwardPorts / portsAttributes now describe ports that are really served.
Flutter differs from CI	.devcontainer/Dockerfile is Ubuntu 24.04 + Flutter cloned at ARG FLUTTER_VERSION=3.47.1 (the cirruslabs registry has no 3.47.x tag). test/guards/devcontainer_flutter_version_test.dart fails when the ARG and flutter-version in ci.yml differ; the image workflow reads the ARG and checks flutter --version.
MySQL 8.4 does not fit the live test	compose profile live-tests: mysql-live = mysql:8.0 + mysql_native_password on MYSQL_LIVE_PORT (default 3307), same server CI starts. Run MYSQL_PORT=3307 flutter test test/core/database/stream_take_drain_test.dart.
bubblewrap missing	installed in the image (plus socat); the smoke test runs bwrap --version.
postStartCommand hides failures, does not wait	the script runs up -d, waits up to QUERYA_STACK_TIMEOUT (180 s) for the five long-running services to be healthy, prints which are not and the compose ps table. It never fails the container start. I did not use up --wait: the one-shot seed jobs (redis-seed, sqlite-seed) exit by design.

docs/dev-containers.md is updated for all of it (the "Known gaps" Flutter workaround is gone).

Not verified here

• The image build and the smoke test run in the Dev container image workflow of this PR (it triggers on .devcontainer/Dockerfile); I did not build it locally. If flutter precache --linux or the git clone of the tag fails there, that is the thing to look at.
• devcontainer_start.sh passes bash -n, and docker compose config accepts the compose file with and without the profile; the forwarding itself was not run inside a dev container.
• The sandbox tests may still skip inside a container because of nested user namespaces (documented).

Acceptance of the issue covered by this PR

• fresh container: psql -h localhost -U querya querya, redis-cli -h localhost ping, flutter --version = 3.47.1 (needs a run in a real container)
• stream_take_drain_test.dart runs with the documented profile

Refs #1487