feat: live docker/database widgets over WebSocket (M2)

Adds a custom server.ts (http server + Next request handler + a
noServer:true WebSocket server on /ws) so the app can push live data
without polling. A CollectorScheduler runs one interval-based job per
docker/database widget instance, backed by dockerode against
/var/run/docker.sock, and reconciles jobs when config.yml changes.

Config hot-reload is now fully wired: chokidar watches config.yml/.env,
re-validates on change, and broadcasts config:update (or a
non-destructive config:error, keeping the last-good config) to every
connected browser. The client subscribes to per-widget topics over a
single shared WebSocket with exponential-backoff reconnect and
last-result caching for instant resubscribe.

Verified end-to-end against real throwaway containers (nginx, redis):
live CPU/mem/uptime/health streamed over the socket, interval changes
picked up without a server restart, and a broken config.yml correctly
falls back to the last-valid config instead of crashing the app.

lib/collectors/docker.ts

@@ -0,0 +1,53 @@
+import Docker from "dockerode";
+import type { ContainerStats } from "dockerode";
+import type { DockerContainerResult } from "@/lib/types/widget-result";
+
+const docker = new Docker({
+  socketPath: process.env.DOCKER_SOCKET_PATH ?? "/var/run/docker.sock",
+});
+
+function calcCpuPercent(stats: ContainerStats): number | null {
+  const cpuDelta = stats.cpu_stats.cpu_usage.total_usage - stats.precpu_stats.cpu_usage.total_usage;
+  const systemDelta = stats.cpu_stats.system_cpu_usage - stats.precpu_stats.system_cpu_usage;
+  const cpuCount = stats.cpu_stats.online_cpus || stats.cpu_stats.cpu_usage.percpu_usage?.length || 1;
+  if (systemDelta <= 0 || cpuDelta < 0) return null;
+  return (cpuDelta / systemDelta) * cpuCount * 100;
+}
+
+const EPOCH_STARTED_AT = "0001-01-01T00:00:00Z";
+
+export async function collectDockerContainer(
+  containerName: string,
+  showStats: boolean
+): Promise<DockerContainerResult> {
+  const container = docker.getContainer(containerName);
+  const inspect = await container.inspect();
+
+  let cpuPercent: number | null = null;
+  let memUsageBytes: number | null = null;
+  let memLimitBytes: number | null = null;
+
+  if (showStats && inspect.State.Running) {
+    const stats = await container.stats({ stream: false });
+    cpuPercent = calcCpuPercent(stats);
+    memUsageBytes = stats.memory_stats.usage ?? null;
+    memLimitBytes = stats.memory_stats.limit ?? null;
+  }
+
+  const startedAt =
+    inspect.State.StartedAt && inspect.State.StartedAt !== EPOCH_STARTED_AT ? inspect.State.StartedAt : null;
+
+  return {
+    status: (inspect.State.Status as DockerContainerResult["status"]) || "unknown",
+    health: (inspect.State.Health?.Status as DockerContainerResult["health"]) || "none",
+    startedAt,
+    uptimeSeconds: startedAt
+      ? Math.max(0, Math.floor((Date.now() - new Date(startedAt).getTime()) / 1000))
+      : null,
+    restartCount: inspect.RestartCount ?? 0,
+    cpuPercent,
+    memUsageBytes,
+    memLimitBytes,
+    image: inspect.Config.Image,
+  };
+}