Phase 1 sub-commit 6: skeleton wiring — make dev runs end-to-end

Symfony app under framework/skeleton/symfony/: minimal bin/console,
public/index.php, MicroKernel-based src/Kernel.php, services.yaml,
framework/security/mercure config, and a demo App\Controller\PingController
that GETs /api/ping (returning JSON pong) and republishes the same
payload to the Mercure topic app://ping. composer.json uses a path
repository to symlink the bundle from ../../php so local edits are
picked up live.

QML app under framework/skeleton/qml/: top-level CMake that
add_subdirectory's framework/qml, a main.cpp that creates the Qt
process, runs SingleInstance.acquireOrForward before any QML loads,
exposes SingleInstance via context property, and loadFromModule's
Skeleton.Main. Main.qml uses BackendConnection / RestClient /
MercureClient from PhpQml.Bridge and renders status dots, a Ping
button, and an event log.

Caddyfile binds 127.0.0.1:8765, enables in-memory Mercure with a
256-bit dev JWT (matches symfony/.env, lcobucci/jwt requires this).
Makefile wraps build / dev / doctor / clean; scripts/dev.sh starts
FrankenPHP --watch and the Qt host together with explicit PID-based
teardown (process-group `kill 0` proved unreliable when frankenphp's
watch fork reparented).

Bug fixes uncovered in this sub-commit:
- SingleInstance.acquireOrForward: probe-first, then removeServer +
  retry-listen. The original loop-with-removeServer-after-failed-bind
  silently exited on stale sockets from prior runs.
- Main.qml: MercureClient does NOT inherit BackendConnection.token —
  Mercure subscribes anonymously in dev (Caddyfile), and forwarding
  the bridge bearer made it 401-loop.
- /api/ping was 500ing because the dev MERCURE_JWT_SECRET was 144 bits;
  bumped to 64-char (>=256 bit) to satisfy lcobucci/jwt.
- Linked the framework lib (php_qml_bridge) explicitly in addition to
  the QML plugin so SingleInstance.h resolves.
- Auto-generated config/reference.php gitignored.

Smoke verified offscreen: /healthz 200, /api/ping 200, 1 publish, 1
subscriber, zero 401s, clean shutdown with no zombies.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

framework/skeleton/scripts/dev.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Start the dev backend (FrankenPHP --watch) and the Qt host together,
+# tearing both down on Ctrl-C / exit / SIGTERM via process-group kill.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SKELETON_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+SYMFONY_DIR="$SKELETON_DIR/symfony"
+QT_BIN="$SKELETON_DIR/build/qml/skeleton"
+
+: "${FRANKENPHP:=frankenphp}"
+: "${BRIDGE_URL:=http://127.0.0.1:8765}"
+: "${BRIDGE_TOKEN:=devtoken}"
+
+if [ ! -x "$QT_BIN" ]; then
+    echo "Qt host not built. Run 'make build' first." >&2
+    exit 1
+fi
+if ! command -v "$FRANKENPHP" >/dev/null 2>&1; then
+    echo "frankenphp not on PATH. Set FRANKENPHP=/path/to/frankenphp or install it." >&2
+    exit 1
+fi
+
+# Explicit PID-based teardown: SIGTERM the children, give them 2s,
+# then SIGKILL anything still alive. process-group `kill 0` proved
+# unreliable when FrankenPHP's --watch fork was reparented.
+FRANKEN_PID=""
+QT_PID=""
+cleanup() {
+    trap - EXIT INT TERM
+    for pid in "$QT_PID" "$FRANKEN_PID"; do
+        [ -n "$pid" ] || continue
+        kill -0 "$pid" 2>/dev/null || continue
+        kill -TERM "$pid" 2>/dev/null || true
+        for _ in 1 2 3 4 5 6 7 8 9 10; do
+            kill -0 "$pid" 2>/dev/null || break
+            sleep 0.2
+        done
+        kill -KILL "$pid" 2>/dev/null || true
+    done
+}
+trap cleanup EXIT INT TERM
+
+(cd "$SYMFONY_DIR" && exec "$FRANKENPHP" run --watch --config ../Caddyfile) &
+FRANKEN_PID=$!
+echo "frankenphp PID=$FRANKEN_PID"
+
+# Wait for the backend to come up. Bail if FrankenPHP dies early.
+for _ in $(seq 1 50); do
+    if curl -fsS -m 1 "$BRIDGE_URL/healthz" >/dev/null 2>&1; then
+        break
+    fi
+    if ! kill -0 "$FRANKEN_PID" 2>/dev/null; then
+        echo "frankenphp died before becoming ready" >&2
+        exit 1
+    fi
+    sleep 0.2
+done
+
+BRIDGE_URL="$BRIDGE_URL" BRIDGE_TOKEN="$BRIDGE_TOKEN" "$QT_BIN" &
+QT_PID=$!
+
+wait "$QT_PID"