Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk
carries no composition rule. The catalogue functions only the
node-engine's composition reaches (Resolve, Resolution's Compose,
Declaration, DataItems, LeftOut, Rules and the rest, the settings,
placeholder and template refusals, the rendering helpers) are copied
with their tests into internal/compose/resolution; a method of a
mesh-sdk shape becomes a function taking it first. The composition
calls its own copies, and the captured catalogue its tests read lives
here now, shared by mesh-compose's tests.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

testdata/beside/mesh-catalog/modules/supabase/files/studio-env.env

@@ -0,0 +1,18 @@
+# Next.js listens on the address HOSTNAME names, and docker sets HOSTNAME to the container's id,
+# so studio answered only on its network address while its image's health check asks localhost:
+# unhealthy for ever while working. Every address, as the upstream compose file has it.
+HOSTNAME=::
+STUDIO_PG_META_URL=http://supabase-meta:8080
+POSTGRES_PASSWORD=${secret:postgres}
+DEFAULT_ORGANIZATION_NAME=Default Organization
+DEFAULT_PROJECT_NAME=Default Project
+OPENAI_API_KEY=${secret:openai}
+SUPABASE_URL=http://supabase-kong:8000
+SUPABASE_PUBLIC_URL=https://${bound:route:name}
+SUPABASE_ANON_KEY=${secret:anon-key}
+SUPABASE_SERVICE_KEY=${secret:service-role-key}
+AUTH_JWT_SECRET=${secret:jwt}
+LOGFLARE_API_KEY=${secret:logflare}
+LOGFLARE_URL=http://supabase-analytics:4000
+NEXT_PUBLIC_ENABLE_LOGS=true
+NEXT_ANALYTICS_BACKEND_PROVIDER=postgres