feat: live docker/database widgets over WebSocket (M2)

Adds a custom server.ts (http server + Next request handler + a
noServer:true WebSocket server on /ws) so the app can push live data
without polling. A CollectorScheduler runs one interval-based job per
docker/database widget instance, backed by dockerode against
/var/run/docker.sock, and reconciles jobs when config.yml changes.

Config hot-reload is now fully wired: chokidar watches config.yml/.env,
re-validates on change, and broadcasts config:update (or a
non-destructive config:error, keeping the last-good config) to every
connected browser. The client subscribes to per-widget topics over a
single shared WebSocket with exponential-backoff reconnect and
last-result caching for instant resubscribe.

Verified end-to-end against real throwaway containers (nginx, redis):
live CPU/mem/uptime/health streamed over the socket, interval changes
picked up without a server restart, and a broken config.yml correctly
falls back to the last-valid config instead of crashing the app.

server.ts

@@ -0,0 +1,58 @@
+import { createServer } from "node:http";
+import next from "next";
+import { attachWebSocketServer } from "./lib/ws/server";
+import { configStore } from "./lib/config/loader";
+import { collectorScheduler } from "./lib/collectors/scheduler";
+
+const port = Number(process.env.PORT ?? 3000);
+const hostname = process.env.HOSTNAME ?? "0.0.0.0";
+const dev = process.env.NODE_ENV !== "production";
+
+const app = next({ dev, hostname, port });
+const handle = app.getRequestHandler();
+
+async function main(): Promise<void> {
+  await app.prepare();
+  const upgradeHandler = app.getUpgradeHandler();
+
+  configStore.load();
+  configStore.watch();
+  collectorScheduler.start(configStore.get());
+  configStore.onUpdate((config) => collectorScheduler.reconcile(config));
+
+  const httpServer = createServer((req, res) => {
+    handle(req, res);
+  });
+
+  const wss = attachWebSocketServer(httpServer);
+
+  httpServer.on("upgrade", (req, socket, head) => {
+    const pathname = new URL(req.url ?? "/", "http://internal").pathname;
+    if (pathname === "/ws") {
+      wss.handleUpgrade(req, socket, head, (ws) => {
+        wss.emit("connection", ws, req);
+      });
+      return;
+    }
+    void upgradeHandler(req, socket, head);
+  });
+
+  function shutdown(): void {
+    collectorScheduler.stop();
+    configStore.stop();
+    httpServer.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 5_000).unref();
+  }
+
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+
+  httpServer.listen(port, () => {
+    console.log(`> PulseNode listening on http://${hostname}:${port}`);
+  });
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});