feat(log-management): ship container logs to external providers via Vector

[narcisonunez]

Adds a Log Management feature (free tier, like Vault's secrets providers): Dokploy can ship a server's container logs to an external provider for retention/search/alerting, without replacing the existing live WebSocket log viewer.

• Runs Vector (Apache-2.0, single binary) as one agent per registered server, plus an optional local agent on the machine Dokploy itself runs on (self-hosted only). Dokploy never implements per-provider HTTP clients — it only translates saved credentials into a Vector sink config.
• Providers: Grafana Loki, Datadog Logs, Better Stack, Elasticsearch/ OpenSearch, Splunk HEC, AWS CloudWatch Logs — via a LogProviderAdapter registry (packages/server/src/services/log-management/providers), mirroring the existing vaultProvider client-registry pattern. Adding a provider needs no router/UI/orchestrator changes, see docs/log-management.md.
• Events are tagged with dokploy_organization/project/environment/application via a generated VRL scoping transform, built from the org's project tree and resynced on every log-management change plus every 15 minutes.
• Two independent toggles gate whether Vector runs at all (per server, and for the local self-hosted host, which a single org "claims" to avoid cross-org credential leakage on a shared instance).
• Generated vector.yaml is validated (vector validate) before being applied, with secrets redacted from any validation error; writes are serialized per server (in-process queue + a Postgres advisory lock for horizontally scaled Cloud) and applied via a write-then-rename to avoid partial configs.
• One invalid provider is isolated at config-build time and skipped instead of breaking log shipping for the rest of the org; cross-field constraints an adapter can't express statically (e.g. Elasticsearch requiring a password whenever a username is set) are rejected at save time too.
• testConnection is permissioned and timeout-bounded like the comparable vaultProvider/registry test-connection paths.

See docs/log-management.md for the full design, known limits (single-node Swarm servers only, no embedded historical log viewer, local-host caveats on a shared self-hosted instance), and the guide for adding a new provider.

What is this PR about?

Please describe in a short paragraph what this PR is about.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

Screenshots (if applicable)

Confidence Score: 4/5

The provider-deletion race still needs fixing before merging because deployment can restore a deleted selection and block later redeploys.

What we checked:

• Missing agents look deployed: inspectVectorStatus returns stopped when service inspection returns 404. The page treats that status as not deployed.

Summary

Adds provider settings and per-server Vector agents to ship container logs to six external providers without replacing the live log viewer.

• Organizations can save destinations for their container logs.

_{Reviews (9) · Last reviewed commit: "fix(log-management): report missing agen..." · Reviewed by Greptile}

[Siumauricio]

@greptile review