feat: add unified monitoring and runtime boundaries (2/6)

[cerede2000]

Summary

PR 2/6 of the complete tested main → integration contribution train. Depends on #220.

• completes the unified monitor with live stats, stack/container selection and lifecycle controls;
• streams updates instead of repeatedly polling Compose status;
• adds image update progress, sortable persistent views and richer rows;
• confines file operations and enforces origin/request-size HTTP boundaries;
• immediately clears stale lifecycle stats and locks contradictory in-flight actions;
• fixes the MUI 9 monitor action layout at the integration boundary.

Validation

• dedicated Go/build/vet/test, vulnerability and frontend workflow: https://github.com/cerede2000/dockman/actions/runs/29796715321

Series mechanics

This is a cumulative draft. After #220 merges, it will be rebased onto updated upstream main, leaving only this second lot.

[vercel]

Someone is attempting to deploy a commit to the r334's projects Team on Vercel.

A member of the Team first needs to authorize it.