feat(docker): add REST API live reload

[scotluns]

Why

This supports the cross-service hot-reload development workflow by letting REST API changes be verified quickly inside the local Compose stack while keeping the runtime path close to the deployed service.

What Changed

• Adds a REST API dev Docker target.
• Installs all dependencies for development and seeds app, bin, and resources so named volumes can be initialized safely.
• Adds start:dev with nodemon --legacy-watch --watch app --watch bin --watch resources ./bin/www.
• Adds the required nodemon dev dependency and lockfile entries.

How To Verify

Start a developer-mode Compose stack with watch enabled from the deployment repo:

./docker/setup-workbench.sh --accept-defaults --dev-mode --taxii-server --instance-name live-reload-smoke
cd instances/live-reload-smoke
docker compose up --watch --build

Verify REST API reload:

$EDITOR ../../../attack-workbench-rest-api/app/controllers/health-controller.js +7

Temporarily change the ping handler to:

return res.status(200).send('rest api watch works');

Then run:

curl -i http://localhost:3000/api/health/ping

Confirm the changed response appears after Compose Watch syncs and nodemon restarts the process. Revert the temporary response change before committing.

Package integrity was also checked with:

npm ci --dry-run --ignore-scripts --no-audit --fund=false
npm install --package-lock-only --ignore-scripts --no-audit --fund=false --dry-run

Related PRs

• Deployment: feat(docker): add live reload workflow attack-workbench-deployment#6

Landing

Merge before the deployment live-reload PR.