fix: predictable container names for tunnel connectivity

- Inject explicit container_name into compose files at start/restart time
  via _ensure_container_name_in_compose() to prevent Docker Compose from
  generating UUID-based auto names that break backend network resolution.
- Use instance.name.lower() directly instead of get_container_name() lookups
  which were unreliable with auto-generated names.
- Apply compose sanitization, bind-address fix, and container-name injection
  on restart_instance as well so restarts pick up template fixes.
- Add --force-recreate to docker compose up to ensure container_name changes
  take effect immediately.
- Fix notification lifecycle tests to match current behavior (success severity,
  health_changed event for ownership test).

Quality gates: ruff clean, pytest (7 notification lifecycle tests passed)

apps/api/tests/integration/test_notifications_lifecycle.py

@@ -149,8 +149,8 @@ async def test_lifecycle_running_creates_notification(
     assert len(notifications) == 1
     n = notifications[0]
     assert n.category == "instance"
-    assert n.severity == "info"
-    assert n.title == "Health Changed"
+    assert n.severity == "success"
+    assert n.title == "Container ready"
     assert n.source_type == "tool_instances"
     assert n.source_id == test_instance.id
 
@@ -315,9 +315,9 @@ async def test_notification_ownership_matches_instance_owner(
         event_bus=event_bus,
         session=db_session,
         instance=instance,
-        event_type="instance.created",
-        status="pending",
-        message="Instance created",
+        event_type="instance.health_changed",
+        status="running",
+        message="Container running",
     )
 
     result = await db_session.execute(