fix: predictable container names for tunnel connectivity

- Inject explicit container_name into compose files at start/restart time
  via _ensure_container_name_in_compose() to prevent Docker Compose from
  generating UUID-based auto names that break backend network resolution.
- Use instance.name.lower() directly instead of get_container_name() lookups
  which were unreliable with auto-generated names.
- Apply compose sanitization, bind-address fix, and container-name injection
  on restart_instance as well so restarts pick up template fixes.
- Add --force-recreate to docker compose up to ensure container_name changes
  take effect immediately.
- Fix notification lifecycle tests to match current behavior (success severity,
  health_changed event for ownership test).

Quality gates: ruff clean, pytest (7 notification lifecycle tests passed)

apps/api/src/services/docker.py

@@ -159,7 +159,7 @@ def execute_compose_command(
         cmd.extend(["--env-file", env_file])
 
     if action == "up":
-        cmd.extend(["up", "-d"])
+        cmd.extend(["up", "-d", "--force-recreate"])
     elif action == "down":
         cmd.extend(["down", "-v"])
     elif action in ("start", "stop", "restart"):