feat(worker): add Docker Compose discovery and management

Add an internal/compose package that discovers Compose projects via
`docker compose ls` + `docker ps` labels (grouped by
com.docker.compose.project/service) and enriches each container with
`docker inspect` ports/mounts and Traefik router labels. Management
runs `docker compose` in each project's working directory for
up/down/stop/restart/pull plus per-service variants and log tails.

Wire it into the webapp: a 60s ComposeRefresher (constructed in New,
started in Start, stopped in Close), a /compose list + detail + logs
HTML surface, and /web/api/compose/* JSON endpoints (list, detail,
logs, project/service lifecycle). Browser lifecycle POSTs are
session+CSRF protected; the /web/api/* variants accept HTTP basic auth.
WORKER_COMPOSE_ENABLED defaults on (false to disable).

Tests cover discovery parsing/grouping/traefik/summary, the action
allowlists, and the full handler surface (list/detail/logs HTML+API,
CSRF enforcement, disabled/unknown-action rejection, audit writes,
success+failure exec paths) via a stub Docker binary.

internal/webapp/templates/compose.html

@@ -0,0 +1,44 @@
+{{define "body"}}<section class="card">
+  <h1>Docker Compose projects</h1>
+  {{if not .Enabled}}
+  <p class="muted">Compose management is disabled (WORKER_COMPOSE_ENABLED=false). Re-enable it and restart the worker to see projects here.</p>
+  {{else}}
+  <p class="muted">Discovered from <code>docker compose ls</code> and <code>docker ps</code> labels, refreshed every 60s. Lifecycle actions (up/down/stop/restart/pull) run <code>docker compose</code> in each project's working directory.</p>
+  {{if .LastAt.IsZero}}
+  <p class="muted">No refresh yet — the first scan runs within 60s of start.</p>
+  {{else}}
+  <p class="muted">Last refresh: {{fmtTime .LastAt}}</p>
+  {{end}}
+  {{range .Snapshot.Errors}}
+  <p class="muted">⚠ {{.}}</p>
+  {{end}}
+  <table>
+    <thead>
+      <tr>
+        <th>Project</th>
+        <th>Status</th>
+        <th>Services</th>
+        <th>Containers</th>
+        <th>Running</th>
+        <th>Compose file</th>
+        <th></th>
+      </tr>
+    </thead>
+    <tbody>
+      {{range .Snapshot.Projects}}
+      <tr>
+        <td>{{.Name}}</td>
+        <td>{{.Status}}</td>
+        <td>{{.ServiceCount}}</td>
+        <td>{{.ContainerCount}}</td>
+        <td>{{.RunningCount}}</td>
+        <td>{{.ConfigFiles}}</td>
+        <td><a href="/compose/{{.Name}}">details</a></td>
+      </tr>
+      {{else}}
+      <tr><td colspan="7" class="muted">No Compose projects discovered.</td></tr>
+      {{end}}
+    </tbody>
+  </table>
+  {{end}}
+</section>{{end}}