align dev tooling with youngstartup conventions

require-dev: phpstan ^2.1 + strict rules, larastan ^3, php-cs-fixer
^3.91 + jubeki/laravel-code-style ^2.18, ide-helper ^3.7. add
phpstan.neon (level max, app/ scope) and .php-cs-fixer.dist.php
(jubeki preset, modifier_keywords rule). phpunit.xml mirrors
youngstartup (sqlite :memory:, bcrypt rounds 4, enforceTimeLimit).
gitignore picks up _ide_helper.php, *~, .php-cs-fixer.cache. drop
sail's phpactor.json line. composer scripts: drop npm bits from
setup/dev (frontend lives separately). composer test + stan +
cs:check all green on default scaffold.

backend/phpstan.neon

@@ -0,0 +1,20 @@
+includes:
+    - vendor/larastan/larastan/extension.neon
+    - vendor/phpstan/phpstan-strict-rules/rules.neon
+
+parameters:
+    level: max
+    treatPhpDocTypesAsCertain: false
+    reportUnmatchedIgnoredErrors: false
+
+    paths:
+        - app
+
+    excludePaths:
+        analyse: [
+            vendor,
+            tests
+        ]
+
+    universalObjectCratesClasses:
+        - stdClass