feat(docker): scan/inspect passifs des stacks Compose (tâche 2 SJ-4)

- 4 tables Docker (settings/compose_roots/compose_stacks/stack_services)
  + migration 0004 (timestamps journal monotones)
- templates docker/scan-compose + inspect-compose ; renderTemplate bascule
  sur délimiteurs <% %> pour les templates docker/ afin de préserver les
  Go-templates {{.ID}} intacts
- dockerScan: parseDockerScan (TDD) + scanDockerStacks (persiste stacks
  candidats, complète la détection par labels)
- action docker_scan branchée dans execute (route dédiée, archivage report/log)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/docker/inspect-compose.sh.tpl

@@ -0,0 +1,16 @@
+#!/bin/sh
+export LC_ALL=C
+cd "<%stackDir%>" || { echo "===SU:DOCKER_ERR==="; echo "compose_not_found"; echo "===SU:EXIT=2==="; exit 2; }
+echo "===SU:DOCKER_CONFIG_IMAGES==="
+docker compose config --images 2>&1
+echo "===SU:DOCKER_PS==="
+docker compose ps --format json 2>&1
+echo "===SU:DOCKER_IMAGES==="
+docker compose images --format json 2>&1
+echo "===SU:DOCKER_INSPECT==="
+docker compose config --images 2>/dev/null | while IFS= read -r img; do
+  docker image inspect "$img" \
+    --format 'IMG\t{{.Id}}\t{{join .RepoDigests ","}}\t{{index .Config.Labels "org.opencontainers.image.version"}}\t{{index .Config.Labels "org.opencontainers.image.source"}}' 2>/dev/null \
+    || echo "IMG_MISSING\t$img"
+done
+echo "===SU:EXIT=0==="

templates/docker/scan-compose.sh.tpl

@@ -0,0 +1,28 @@
+#!/bin/sh
+export LC_ALL=C
+echo "===SU:DOCKER_SCAN==="
+ROOTS="<%composeRoots%>"
+DEPTH="<%composeScanDepth%>"
+for root in $ROOTS; do
+  [ -d "$root" ] || continue
+  find "$root" -maxdepth "$DEPTH" -type f \
+    \( -name 'compose.yaml' -o -name 'compose.yml' \
+       -o -name 'docker-compose.yaml' -o -name 'docker-compose.yml' \) \
+    -not -path '*/.git/*' -not -path '*/node_modules/*' \
+    -not -path '*/backup/*' -not -path '*/old/*' -not -path '*/archive/*' \
+    2>/dev/null | while IFS= read -r f; do
+      dir=$(dirname "$f")
+      if docker compose -f "$f" config --quiet >/dev/null 2>&1; then
+        echo "STACK_OK\tdir=$dir\tfile=$f"
+      else
+        echo "STACK_INVALID\tdir=$dir\tfile=$f"
+      fi
+  done
+done
+echo "===SU:DOCKER_LABELS==="
+docker ps --format '{{.ID}}' 2>/dev/null | while read -r id; do
+  proj=$(docker inspect --format '{{index .Config.Labels "com.docker.compose.project"}}' "$id" 2>/dev/null)
+  wd=$(docker inspect --format '{{index .Config.Labels "com.docker.compose.project.working_dir"}}' "$id" 2>/dev/null)
+  [ -n "$proj" ] && echo "ACTIVE\tproject=$proj\tworking_dir=$wd"
+done
+echo "===SU:EXIT=0==="