feat: harden browsers and add volume browsing (5/6)

[cerede2000]

Summary

PR 5/6 of the complete tested main → integration contribution train. Depends on #223.

• hardens root, read-only and minimal-container browsing fallbacks;
• detects writable bind/volume paths inside read-only root filesystems;
• adds chmod and chown plus reliable TAR/ZIP downloads;
• tolerates volatile /dev and /proc entries and stabilizes navigation state;
• adds the matching volume filesystem browser and compact volume-details overlay;
• adds flat container-list monitor mode, optional charts and status-derived row colors.

Mutating controls remain disabled for paths that are effectively read-only.

Validation

• dedicated Go/build/vet/test, vulnerability and frontend workflow: https://github.com/cerede2000/dockman/actions/runs/29796718047
• manual traversal tests covered writable, read-only, mounted and minimal containers during integration

Series mechanics

This is a cumulative draft. It will be rebased after #220–#223 merge, leaving only this hardening and volume-browser lot.

[vercel]

Someone is attempting to deploy a commit to the r334's projects Team on Vercel.

A member of the Team first needs to authorize it.