barista up: a local café with the API, barakoBrew, barakoPress and a tenant, in one command

Part of #801. A barako expert starts every client the same way: the API, barakoBrew, barakoPress and Postgres running locally, with a tenant, ready to configure. Today create-barako-app brings up the API and barakoBrew with a Next.js starter, but not barakoPress in its configured, many-tenant mode (BaryoDev/barakoPress#20), and it is a project generator rather than a command an agent can run and tear down.

## Change

- `barista up` starts a local café from the published images: Postgres, barakoCMS, barakoBrew and barakoPress, with generated secrets, the renderer key (#823) wired between barakoPress and the API, and one tenant with a local domain such as `client.localhost`.
- `barista up --kit ` applies a site kit (#721) so the café opens with a model, a theme and pages.
- `barista status`, `barista down` (keeps data) and `barista reset` (drops it, asks first).
- Pinned image versions per barista release, so a café made today behaves the same next month; `barista up --latest` to try new ones.
- The same compose file BaryoVM deploys (BaryoDev/BaryoVM#84), so local and production differ only in configuration.
- create-barako-app calls this for its backend instead of carrying its own compose.

## Done when

- On a machine with Docker, `barista up --kit rckoronadal` then opening `http://client.localhost` shows the home page, and barakoBrew at its local URL edits it, in under five minutes.

Start by tracing how create-barako-app currently launches the API and barakoBrew, then compare the shared compose setup referenced for BaryoVM. Verify the resulting barista commands against the stated Docker acceptance flow: `barista up --kit rckoronadal` should open the tenant home page and its local barakoBrew editor within five minutes, while status, down and reset behave as specified.

Written by the indexing model from the issue text.