feat: add secure container filesystem browsing (4/6)

[cerede2000]

Summary

PR 4/6 of the complete tested main → integration contribution train. Depends on #222.

Introduces secure container filesystem browsing without assuming that the target image provides a shell, ls, find or tar:

• bounded helper and Docker archive paths;
• navigation, sorting, hidden files, refresh and row actions;
• upload, create file/folder, rename, delete and download;
• TAR/ZIP directory downloads and permission handling;
• initial read-only compatibility behavior.

Validation

• dedicated Go/build/vet/test, vulnerability and frontend workflow: https://github.com/cerede2000/dockman/actions/runs/29796717172

Series mechanics

This is a cumulative draft. It will be rebased after the preceding PRs merge, leaving only the initial filesystem-browser lot.

[vercel]

Someone is attempting to deploy a commit to the r334's projects Team on Vercel.

A member of the Team first needs to authorize it.