## Why

`tnx-pos` has no automated deployment path: every push to the dev server is done by hand, so the state of the dev environment depends on who last copied files onto it. The sibling project `sugahrm/hrm-api` already runs a proven tag-triggered GitLab CI deploy onto the same shared dev infrastructure, so adopting that flow verbatim gives `tnx-pos` a repeatable dev deploy without inventing anything new.

## What Changes

- Add `.gitlab-ci.yml` with a single `pos-dev` job, ported from the `api-dev` job of `hrm-api`. It triggers only on tags matching `^dev-[0-9]{10}$`, runs on the `web_dev` shell runner, wipes and repopulates `$DEV_DIR/src`, promotes `.env.dev` to `.env`, then runs `migrate`, `storage:link`, `cache:clear`, `config:clear`.
- Add `.env.dev`, cloned from `.env.example` with dev-server values filled in and a pre-generated `APP_KEY` baked in, so the pipeline never runs `key:generate` and never rotates the key between deploys. The file is committed deliberately — `.gitignore` ignores `.env` only.
- Drop the steps from `api-dev` that have no counterpart in this codebase: `passport:keys`, `permissions:autoload`, `administrative-units:import` (no Laravel Passport, no such Artisan commands here).
- Drop `composer install` from `before_script`: `vendor/` is already committed in this repo (7146 tracked files, alongside `composer.phar` and `patch_package_manifest.php`), so re-resolving dependencies on the runner adds risk without adding value for a Laravel 5.6 app.

**Non-goals for this change:** the `api-test` / `api-stg` jobs, the `deploy/*.sh` versioning helpers, `.deploy.sh`, the `@w3suga/w3s-cli` tagging wrapper, and any frontend asset build. Dev environment only; compiled assets under `public/css` and `public/js` are already committed.

## Capabilities

### New Capabilities

None. This change adds CI configuration and an environment file; no application behavior changes, so no spec describes it. The change sets `skip_specs: true` in its `.openspec.yaml`.

### Modified Capabilities

None.

## Impact

**Files added:** `.gitlab-ci.yml`, `.env.dev`. No existing file is modified — `.gitignore` already permits `.env.dev`, and `package.json` needs no new scripts because tagging is done with plain `git tag`.

**Deploy target:** `/var/www/html/tnx_pos_2026/dev/pos/src`, following the `$PRJ_DIR/dev/$PRJ_NAME` convention from `hrm-api`.

**Server-side prerequisites (outside this repo, one-time):** create the `w3s_tnxpos_dev` database and grant access; point a vhost at `$DEV_DIR/src/public`; register the `web_dev` runner for the `dev/small-projects/tnx-pos` project; grant the runner user passwordless `sudo rm -rf`.

**Known risk:** `hrm-api` requires PHP `^7.3|^8.0` while `tnx-pos` is Laravel `5.6.*`, which does not run on PHP 8. If the shared dev host serves `hrm-api` on PHP 8.x, `tnx-pos` needs its own PHP-FPM 7.x pool. This is a server configuration matter, not a repo change, but it is the most likely cause of a failed first deploy.