refactor: split services/docker.py into docker/ package

Split monolithic docker.py into focused modules:
- docker/compose.py — compose generation, execute_compose_command, volume sorting
- docker/container.py — container status, IP, logs, network, port finding
- docker/config_staging.py — instance dir, env file, config file staging
- docker/tunnel.py — cloudflared tunnel lifecycle (moved from services/tunnel.py)
- docker/__init__.py — re-exports all public symbols for backward compatibility
- services/tunnel.py — thin re-export wrapper for backward compatibility

Also includes schema extraction files created in prior work:
- schemas/config/config_profile.py
- schemas/project/*.py
- schemas/system/health.py
- schemas/tool/*.py
- schemas/user/*.py

All existing imports like 'from src.services.docker import X' and
'from src.services.tunnel import X' continue to work unchanged.

Quality gates: py_compile passed, ruff passed, import test passed.

progress.md

@@ -0,0 +1,30 @@
+# Progress
+
+## Status
+In Progress — Backend structural refactoring
+
+## Tasks
+- [x] Phase 0: Create submodule directory structure (__init__.py files)
+- [x] Phase 1: Model subpackages (tool, config, user, project, system)
+- [x] Phase 2: Docker service package split (compose, container, config_staging, tunnel)
+- [ ] Phase 3: Service subpackages (instance, config, git, build, terminal, shared)
+- [ ] Phase 4: Schema extraction (tool, config, user, project, system)
+- [ ] Phase 5: API router subpackages (tool, config, workspace, user, project, system)
+- [ ] Phase 6: Auth dependency refactor
+- [ ] Phase 7: Frontend reorganization
+- [ ] Phase 8: Integration and verification
+
+## Files Changed
+- `apps/api/src/services/docker.py` → deleted (split into package)
+- `apps/api/src/services/docker/__init__.py` — re-exports all public functions
+- `apps/api/src/services/docker/compose.py` — compose generation & commands
+- `apps/api/src/services/docker/container.py` — container runtime queries
+- `apps/api/src/services/docker/config_staging.py` — file staging into instances
+- `apps/api/src/services/docker/tunnel.py` — cloudflared tunnel lifecycle
+- `apps/api/src/services/tunnel.py` — thin backward-compat re-export wrapper
+
+## Notes
+- All backward-compatible imports preserved via __init__.py re-exports
+- `from src.services.docker import X` continues to work for all previously exported symbols
+- `from src.services.tunnel import X` continues to work via re-export wrapper
+- No behavior changes, pure structural refactor