feat(events): broadcast state-invalidate on docker events so dashboard updates live (#768)

Dashboard and sidebar status indicators previously only refreshed on a
5-30 second polling cadence: a container restart, a degraded -> healthy
transition, or a stack update was invisible until the next tick.

Add a lightweight, non-persisted "state-invalidate" envelope on the
existing /ws/notifications WebSocket:

Backend
- NotificationService.broadcastEvent: sibling of dispatchAlert that
  pushes an arbitrary {type, ...} envelope to every subscriber WITHOUT
  writing to the alerts history (these are pure ephemeral signals).
- DockerEventService.handleEvent: emit the envelope for state-changing
  container actions (start/die/kill/destroy/create/restart/pause/
  unpause/health_status/rename/update). Carries node id, stack name
  (from the compose project label), container id, action, and
  timestamp.

Frontend
- EditorLayout's two notification WebSocket handlers (local plus
  per-remote-node) branch on type. On state-invalidate they re-emit a
  window CustomEvent and trigger a debounced (250ms) refreshStacks so
  a burst of events from compose recreating multiple services
  collapses to one refetch. The refresh callback is held in a ref so
  the long-lived WS effect never closes over a stale function.
- useDashboardData listens for the same window event and refetches
  /stats, /system/stats, and /stacks/statuses on every signal.
  Historical metrics stay on their 60s polling cadence (10-minute
  trend data, not a live indicator).

Tests
- Three new docker-event-service cases assert broadcastEvent fires on
  start and health_status events with the correct envelope shape, and
  does not fire on non-state actions like exec_create.
- Existing 28 cases updated with the broadcastEvent mock so the
  subscriber stub matches the new shape.

Polling stays as a safety net at the same intervals; the WS path is
the fast path. Multi-node fleets benefit on the local node today;
extending the remote forwarder to relay state-invalidate is a
recommended follow-up.

backend/src/services/NotificationService.ts

@@ -52,6 +52,25 @@ export class NotificationService {
         }
     }
 
+    /**
+     * Broadcast an arbitrary non-notification event envelope to every
+     * currently-open subscriber WITHOUT writing it to the alerts history.
+     *
+     * Used by DockerEventService to push lightweight `state-invalidate`
+     * signals so the UI can refetch stack statuses on a real container event
+     * instead of waiting for the next polling tick. Persisting these would
+     * spam the notifications panel; they are pure ephemeral signals.
+     */
+    public broadcastEvent(envelope: { type: string; [key: string]: unknown }): void {
+        if (this.subscribers.size === 0) return;
+        const msg = JSON.stringify(envelope);
+        for (const ws of this.subscribers) {
+            if (ws.readyState === WebSocket.OPEN) {
+                ws.send(msg);
+            }
+        }
+    }
+
     /**
      * Dispatch an alert: log to history, push via WebSocket, and route to
      * external channels.