feat(resources): add image details sheet with layer history (#925)

Adds a read-only inspect panel for Docker images. Click the eye icon on
any image row to open a sheet showing:

- Overview: ID (with copy), size, created date, arch/OS, author, tags
- Config: Cmd, Entrypoint, WorkingDir, User, exposed ports, env (collapsible),
  labels (collapsible)
- Layers: ordered history list with size, age, and build command per layer.
  Empty layers (metadata-only) are dimmed.

Backend adds DockerController.inspectImage(id) which combines image.inspect()
and image.history() in parallel, exposed via GET /api/system/images/:id.
The route accepts both bare hex IDs and sha256-prefixed IDs, since the list
endpoint surfaces the prefixed form. Returns 400 for malformed IDs and 404
for missing images.

Documents the new panel in docs/features/resources.mdx under Images.

backend/src/routes/systemMaintenance.ts

@@ -135,6 +135,25 @@ systemMaintenanceRouter.get('/networks', async (req: Request, res: Response) =>
   }
 });
 
+systemMaintenanceRouter.get('/images/:id', async (req: Request, res: Response) => {
+  try {
+    const rawId = req.params.id as string;
+    if (!rawId) return res.status(400).json({ error: 'Invalid image ID format' });
+    const hexId = rawId.startsWith('sha256:') ? rawId.slice('sha256:'.length) : rawId;
+    if (!isValidDockerResourceId(hexId)) {
+      return res.status(400).json({ error: 'Invalid image ID format' });
+    }
+    const result = await DockerController.getInstance(req.nodeId).inspectImage(hexId);
+    res.json(result);
+  } catch (error: unknown) {
+    console.error('Failed to inspect image:', error);
+    const err = error as Record<string, unknown>;
+    const is404 = (typeof err.statusCode === 'number' && err.statusCode === 404)
+      || (error instanceof Error && error.message.includes('404'));
+    res.status(is404 ? 404 : 500).json({ error: is404 ? 'Image not found' : 'Failed to inspect image' });
+  }
+});
+
 systemMaintenanceRouter.post('/images/delete', async (req: Request, res: Response) => {
   if (!requireAdmin(req, res)) return;
   try {