Add VS Code configuration and improve developer documentation

- Add VS Code launch configuration example and settings
- Create detailed BUILD.md with setup instructions
- Add keys.example.json for configuration reference
- Update .gitignore to exclude development files
- Remove unused InvitationActiveKeys functionality from config

.gitignore

···
 localdev/calendars-data/
 
 **/.claude/settings.local.json
+CLAUDE.local.md
 Cargo.lock
+/keys.json
+/.vscode/launch.json

.vscode/launch.example.json

···
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "lldb",
+            "request": "launch",
+            "name": "Debug executable 'smokesignal'",
+            "cargo": {
+                "args": [
+                    "build",
+                    "--bin=smokesignal"
+                ],
+                "filter": {
+                    "name": "smokesignal",
+                    "kind": "bin"
+                }
+            },
+            "args": [],
+            "cwd": "${workspaceFolder}",
+            "env": {
+                "DEBUG": "true",
+                "HTTP_PORT": "3100",
+                "EXTERNAL_BASE": "your-hostname",
+                "HTTP_COOKIE_KEY": "Iteax8DsUgOrQJdES+zMa6JKYlbQkewl42Y1bO1ExSyB9jkUktrdKwwWSu+X58T20liLmsegL3LbQB0FvE1AEA",
+                "DATABASE_URL": "postgres://postgres:password@postgres/smokesignal",
+                "OAUTH_ACTIVE_KEYS": "01JV2SGY5K5KW5V4YS0YQ352FD",
+                "DESTINATION_KEY": "01JV2SGY5K5KW5V4YS0YQ352FD",
+                "SIGNING_KEYS": "/workspace/keys.json",
+                "RUST_LOG": "smokesignal=debug,html5ever=info,info"
+            }
+        }
+    ]
+}

.vscode/settings.json

···
+{
+    "files.associations": {
+        "*.html": "jinja-html"
+    }
+}

BUILD.md

···
+# Build
+
+This project uses the stable Rust toolchain (1.86 as of 5/12/25).
+
+## Bare Metal
+
+If you're not using devcontainers, you'll need to install Rust and the necessary dependencies on your system.
+
+### Prerequisites
+
+- Rust toolchain (1.86 or newer)
+- PostgreSQL
+- Redis or Valkey
+- SQLx CLI: `cargo install sqlx-cli@0.8.3 --no-default-features --features postgres`
+
+### Common Commands
+
+- Build: `cargo build`
+- Check: `cargo check`
+- Lint: `cargo clippy`
+- Run tests: `cargo test`
+- Run server: `cargo run --bin smokesignal`
+- Run with debug: `RUST_BACKTRACE=1 RUST_LOG=debug cargo run`
+- Run database migrations: `sqlx migrate run`
+
+### Build Options
+
+- Build with embedded templates: `cargo build --bin smokesignal --no-default-features -F embed`
+- Build with template reloading: `cargo build --bin smokesignal --no-default-features -F reload`
+
+## Devcontainers (Recommended)
+
+The easiest way to get started is by using the provided devcontainer configuration with Visual Studio Code.
+
+### Setup
+
+1. Install [Visual Studio Code](https://code.visualstudio.com/)
+2. Install the [Dev Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
+3. Clone this repository
+4. Open the repository in VS Code
+5. When prompted, click "Reopen in Container" or run the "Dev Containers: Reopen in Container" command
+
+The devcontainer will set up the following services:
+- Rust development environment with all dependencies
+- PostgreSQL database
+- Valkey (Redis-compatible) key-value store 
+- Tailscale networking (optional)
+
+### Disabling Tailscale
+
+If you don't need the Tailscale service, you can disable it by:
+
+1. Open `.devcontainer/docker-compose.yml`
+2. Comment out or remove the `tailscale` service section
+3. Rebuild the devcontainer (Command Palette > "Dev Containers: Rebuild Container")
+
+### VS Code Configuration
+
+The devcontainer comes with recommended VS Code extensions for Rust development:
+- Rust Analyzer
+- Jinja HTML
+- Even Better TOML
+
+A launch configuration example is provided in `.vscode/launch.example.json`. Copy this to `.vscode/launch.json` to enable debugging in VS Code.
+
+## Development Configuration
+
+The application requires several environment variables for cryptographic operations. You can generate appropriate values using the included `crypto` binary.
+
+### Generating Cryptographic Keys
+
+Generate a random 64-byte key encoded in base64:
+
+```
+cargo run --bin crypto -- key
+```
+
+Generate a JWK (JSON Web Key):
+
+```
+cargo run --bin crypto -- jwk
+```
+
+The generated JWK should be added to a JWKS (JSON Web Key Set) in the file `keys.json`:
+
+```json
+{
+    "keys": [
+      { "kid": "01J7PM272ZF0DYZAPR3499VBTM" ...},
+      { "kid": "01J8G3J3CDVJ15C63PMCDS3K97" ...},
+      { "kid": "01JF2QS2S86SG2R23HTZ0JKB76" ...}
+    ]
+  }
+  ```
+
+### Environment Variables
+
+Set the following environment variables with values generated from the commands above:
+
+- `SIGNING_KEYS`: The path to the `keys.json` file
+- `OAUTH_ACTIVE_KEYS`: A comma seperated list of JWK IDs used to actively sign OAuth sessions
+- `DESTINATION_KEY`: A JWK ID used to sign destination (used in redirects) values
+- `HTTP_COOKIE_KEY`: A key used to encrypt HTTP sessions
+
+You can add these to your .env file or set them directly in your environment.
+
+### Additional Configuration for Airgapped Development
+
+For airgapped development, you can configure:
+
+- `PLC_HOSTNAME`: Custom PLC hostname for development
+- `DNS_NAMESERVERS`: Custom DNS nameservers
+- `ADMIN_DIDS`: Comma-separated list of admin DIDs
+
+Example:
+```
+PLC_HOSTNAME=localhost:3000
+DNS_NAMESERVERS=1.1.1.1,1.0.0.1
+ADMIN_DIDS=did:plc:yourdevdid1,did:plc:yourdevdid2
+```

keys.example.json

···
+{
+    "keys": [
+        {
+            "kid": "01JV2SGY5K5KW5V4YS0YQ352FD",
+            "alg": "ES256",
+            "kty": "EC",
+            "crv": "P-256",
+            "x": "okqcK-HmgQ84GP8GkyrvcMM72o-mWZnf2vYgUbI7p0s",
+            "y": "9QFqzeTesLf8n2VDs2JYzuMGjNBIch2hI7UwWMaequ8",
+            "d": "dgR4jSo6ANIyVXuh86B8IhFkFfBMhAtaaii9KPzlHfk"
+        }
+    ]
+}

src/config.rs

···
 pub struct OAuthActiveKeys(Vec<String>);
 
 #[derive(Clone)]
-pub struct InvitationActiveKeys(Vec<String>);
-
-#[derive(Clone)]
 pub struct AdminDIDs(Vec<String>);
 
 #[derive(Clone)]
···
     pub plc_hostname: String,
     pub signing_keys: SigningKeys,
     pub oauth_active_keys: OAuthActiveKeys,
-    pub invitation_active_keys: InvitationActiveKeys,
     pub destination_key: SecretKey,
     pub redis_url: String,
     pub admin_dids: AdminDIDs,
···
         let oauth_active_keys: OAuthActiveKeys =
             require_env("OAUTH_ACTIVE_KEYS").and_then(|value| value.try_into())?;
 
-        let invitation_active_keys: InvitationActiveKeys =
-            require_env("INVITATION_ACTIVE_KEYS").and_then(|value| value.try_into())?;
-
         let destination_key = require_env("DESTINATION_KEY").and_then(|value| {
             signing_keys
                 .0
···
             database_url,
             signing_keys,
             oauth_active_keys,
-            invitation_active_keys,
             http_cookie_key,
             destination_key,
             redis_url,
···
     }
 }
 
-impl AsRef<Vec<String>> for InvitationActiveKeys {
-    fn as_ref(&self) -> &Vec<String> {
-        &self.0
-    }
-}
-
-impl TryFrom<String> for InvitationActiveKeys {
-    type Error = anyhow::Error;
-    fn try_from(value: String) -> Result<Self, Self::Error> {
-        let values = value
-            .split(';')
-            .map(|s| s.to_string())
-            .collect::<Vec<String>>();
-        if values.is_empty() {
-            return Err(ConfigError::EmptyInvitationActiveKeys.into());
-        }
-        Ok(Self(values))
-    }
-}
-
 impl AsRef<Vec<String>> for AdminDIDs {
     fn as_ref(&self) -> &Vec<String> {
         &self.0
···
         Ok(Self(nameservers))
     }
 }
-
-// Default implementation for testing
-#[cfg(test)]
-impl Default for Config {
-    fn default() -> Self {
-        // Create a random key for testing
-        let cookie_key_data = [0u8; 64];
-        let http_cookie_key = HttpCookieKey(Key::from(&cookie_key_data));
-
-        // Create empty collections
-        let signing_keys = SigningKeys(OrderMap::new());
-        let oauth_active_keys = OAuthActiveKeys(Vec::new());
-        let invitation_active_keys = InvitationActiveKeys(Vec::new());
-        let certificate_bundles = CertificateBundles(Vec::new());
-
-        // Create a default admin DID for testing
-        let admin_dids = AdminDIDs(vec!["did:plc:testadmin".to_string()]);
-
-        // Create empty DNS nameservers list for testing
-        let dns_nameservers = DnsNameservers(Vec::new());
-
-        Self {
-            version: "test-version".to_string(),
-            http_port: HttpPort(8080),
-            http_cookie_key,
-            external_base: "https://test.example".to_string(),
-            certificate_bundles,
-            user_agent: "smokesignal-test".to_string(),
-            database_url: "sqlite://test.db".to_string(),
-            plc_hostname: "plc.test".to_string(),
-            signing_keys,
-            oauth_active_keys,
-            invitation_active_keys,
-            // For testing, this needs to be a valid P-256 key
-            // This would normally come from the signing keys, but for tests
-            // we'll create a dummy one - note that it won't actually be used.
-            destination_key: SecretKey::random(&mut rand::thread_rng()),
-            redis_url: "redis://localhost:6379".to_string(),
-            admin_dids,
-            dns_nameservers,
-        }
-    }
-}