feat(docker): routes de gestion des stacks (settings/roots/scan/list/enable)

Rend le flux Docker déclenchable via l'API (prérequis SJ-5/SJ-6) :
- GET  /machines/:id/docker/settings — settings + racines Compose
- POST /machines/:id/docker/roots    — déclare/active les racines à scanner
- POST /machines/:id/docker/scan     — scan passif (background, WS)
- GET  /machines/:id/docker/stacks   — liste stacks + services
- PATCH /machines/:id/docker/stacks/:stackId — cycle candidate→enabled→ignored

dockerScan: getDockerSettings, listStacks, setStackStatus. Les actions
pull-check/apply/down restent réservées aux stacks enabled.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/routes/docker.ts

@@ -0,0 +1,45 @@
+// server/routes/docker.ts
+import { Hono } from "hono";
+import { runAction } from "../services/execute.js";
+import {
+  getDockerSettings,
+  setDockerRoots,
+  listStacks,
+  setStackStatus,
+  type StackStatus,
+} from "../services/dockerScan.js";
+
+export const dockerRoutes = new Hono();
+
+// Paramètres Docker (settings + racines Compose déclarées).
+dockerRoutes.get("/:id/docker/settings", (c) => c.json(getDockerSettings(c.req.param("id"))));
+
+// Déclare/active les racines Compose à scanner.
+dockerRoutes.post("/:id/docker/roots", async (c) => {
+  const body = (await c.req.json()) as { paths?: string[]; scanDepth?: number };
+  if (!Array.isArray(body.paths)) return c.json({ error: "paths[] requis" }, 400);
+  setDockerRoots(c.req.param("id"), body.paths, body.scanDepth ?? 4);
+  return c.json(getDockerSettings(c.req.param("id")), 201);
+});
+
+// Déclenche un scan (passif) en arrière-plan ; suivi via WebSocket.
+dockerRoutes.post("/:id/docker/scan", (c) => {
+  runAction(c.req.param("id"), "docker_scan").catch((err) =>
+    console.error("[docker_scan]", (err as Error).message),
+  );
+  return c.json({ ok: true, action: "docker_scan" }, 202);
+});
+
+// Liste les stacks détectés (+ services).
+dockerRoutes.get("/:id/docker/stacks", (c) => c.json(listStacks(c.req.param("id"))));
+
+// Cycle de vie d'un stack : candidate → enabled (validé) → ignored…
+dockerRoutes.patch("/:id/docker/stacks/:stackId", async (c) => {
+  const body = (await c.req.json()) as { status?: StackStatus };
+  if (!body.status) return c.json({ error: "status requis" }, 400);
+  try {
+    return c.json(setStackStatus(c.req.param("id"), c.req.param("stackId"), body.status));
+  } catch (err) {
+    return c.json({ error: (err as Error).message }, 400);
+  }
+});