stage-26b: Docker topology in /admin — read-only socket-proxy + graph

New tecnativa/docker-socket-proxy sidecar exposes only GET on
containers/networks/info/ping; POST and DELETE are blocked. The cockpit
queries it over the backend network — /var/run/docker.sock is never
mounted into a web-facing container.

cockpit/docker_view.py normalizes the daemon view: containers carry
per-network IP/MAC + published_ports; networks carry subnet/gateway from
IPAM; host_info pulls /info (degrades gracefully). topology() returns
the combined snapshot.

/admin/docker (admin-gated): a force-directed graph (pure SVG +
vanilla JS, ~280 lines) renders the complete setup — a host node,
switch nodes with subnet labels colored by driver, container nodes
colored by state, member wires labeled with the container's IP on that
network, uplinks from non-internal switches to the host labeled with
the gateway, and dashed publish-edges from containers to the host for
their published ports. Drag to rearrange, scroll to zoom, re-settle
kicks the physics. Below the graph: containers table + grouped network
cards as a textual mirror. 12 docker_view tests; verified live (32
containers, 11 switches, real subnets + gateways).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -23,6 +23,7 @@ services:
       PSYC_MOCK_CERT_URL: http://mock-cert:8770
       PSYC_SOAR_URL: http://mock-cert:8770
       PSYC_INFERENCE_URL: http://inference:8771
+      PSYC_DOCKER_PROXY: http://docker-socket-proxy:2375
     ports:
       - "8767:8767"          # direct/debug access; the proxy serves psyc.neuronetz.ai on :80
     volumes:
@@ -48,6 +49,24 @@ services:
       timeout: 5s
       retries: 3
 
+  # Read-only Docker daemon proxy. The cockpit's /admin/docker view queries this
+  # over the backend network instead of touching /var/run/docker.sock directly,
+  # so a compromise of the web app can't drive the daemon. Only GET on
+  # containers/networks/ping is enabled — POST/DELETE/EXEC stay blocked.
+  docker-socket-proxy:
+    image: tecnativa/docker-socket-proxy:0.3
+    environment:
+      CONTAINERS: "1"
+      NETWORKS: "1"
+      PING: "1"
+      INFO: "1"
+      POST: "0"
+      DELETE: "0"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks: [backend]
+    restart: unless-stopped
+
   # The live fine-tuned model behind the Classifier bot. GPU-only — opt in with
   # `--profile gpu`. Uses the psyc-trainer image (built from Dockerfile.train).
   inference: