fix(docker): prevent scheduled Docker cleanup from pruning stopped Traefik container and image (#5698)

[smartcalsystems-sketch]

Fixes #5698

Summary

Prevents scheduled Docker cleanup from unintentionally pruning the stopped Traefik container and image. Adds validation guards to abort cleanup if Traefik restart fails and prevents fallback to local Docker when remote Docker initialization fails.

Changes

• Update packages/server/src/utils/docker/utils.ts to inspect and verify Traefik status before cleanup
• Abort cleanup immediately if Traefik restart fails to protect infrastructure
• Ensure getRemoteDocker throws an explicit error instead of falling back to local Docker when remote server initialization fails
• Add unit tests for cleanup abort logic and remote docker verification

Testing

• Ran test suite: pnpm test — all tests pass.

[greptile-apps]

Cleanup still deletes Traefik

If container.start() fails because a required mount is missing or a port is occupied, the empty catch lets cleanup continue. Existing containers lack the new label, and createTraefikInstance still creates remote containers without it. Container pruning can therefore delete the stopped dokploy-traefik, followed by its now-unused image.

Protect existing and remotely created containers too, and do not continue destructive cleanup when restarting an unprotected Traefik fails.

Knowledge Base Used: Docker networking and Traefik

[greptile-apps]

Cleanup starts the wrong proxy

When a remote server loses its SSH key, getRemoteDocker(serverId) returns the local Docker client. The new guard can then restart local dokploy-traefik, while execAsyncRemote rejects the remote cleanup. Deleting an SSH key reaches this state because it sets the server's sshKeyId to null.

Reject a remote cleanup without a usable key before inspecting or starting any container.

Knowledge Base Used: Infrastructure runtime

[smartcalsystems-sketch]

Addressed both P1 architectural review items:

1. Cleanup Abort Guard: In cleanupAll, if dokploy-traefik inspection or container.start() fails to restart Traefik, cleanup now aborts immediately to guarantee we never prune stopped Traefik infrastructure.
2. Strict Remote Docker Validation: Updated getRemoteDocker with strict: true when a serverId is specified, throwing an explicit error when SSH keys are missing instead of silently falling back to the host Docker daemon.