In the spirit of "going in with more knowledge":
Html/Css can be hidden with
robots.txt, but be sure to change those files when you push the site to production.
robots.txt does not prevent some random person guessing the development website (if it is visible to the whole world).
.htaccess could be used to add a username/password combo to any site being developed.
Here is an example of how you could use a VPN:
All requests on the VPN go through a firewall. That firewall (running some software like pfSense) examines website requests and does some redirection based on url. For example, the url http://example.com.staging will direct to the version of example.com on your staging server, and the url of http://example.com.development will direction to the version of example.com on your development server.
Since all of this is on a private VPN, none of these websites are accessible from the outside world.
Also, to clarify some things with your original question. The php/mysql work is being done server side, so web crawlers, browsers, etc. never see the code--they only see the output of the code (that is, if you've configured your server correctly and aren't rendering .php files as text).
I'm sure I've misread your question, but I found your use of the phrase "local storage" ambiguous. LocalStorage can also refer to an HTML5 technology for storing assets locally on a client's machine. It is not used for rendering html/css, it is only a datastore (the browser renders the html/css). Local storage typically has nothing to do with how companies keep websites hidden in development.
PHP files can be viewed locally if you are running a web server on your machine and the files are in the appropriate directories (usually the
htdocs directory if running Apache).