feat: docker run to compose converter (#623)

* feat(convert): harden /api/convert endpoint with auth, validation, and tests

Applies authMiddleware to the docker run to compose endpoint, validates
that the payload is a non-empty string within an 8192 character budget,
rejects inputs containing null bytes, and wraps composerize in a
try/catch that surfaces a 422 with a clear message when the library
cannot produce a services block. Adds a Vitest suite covering the auth
gate, happy path, common flag coverage, boundary and null byte
placement variants, and malformed command handling.

* feat(editor): add From Docker Run tab to create stack dialog

Introduces a third tab in the Create New Stack dialog that accepts a
docker run command, calls the converter endpoint, and previews the
returned compose YAML before writing it to a new stack directory. Uses
the defensive toast pattern, clears the stale preview when the input
changes, and rolls back the empty stack directory if saving the
converted YAML fails so the user never ends up with an orphan stack.

* docs(stack-management): document docker run to compose converter

Adds a Convert from a docker run command section to the stack
management page covering how to use the new tab, the list of supported
flags, and troubleshooting for unparseable inputs. Screenshots show the
empty tab, a successful conversion with the compose preview, the
resulting stack in the editor, and the error toast surfaced when the
input cannot be converted. Appends a matching entry to the
troubleshooting page.

backend/src/index.ts

@@ -4947,19 +4947,47 @@ app.get('/api/stacks/:stackName/backup', async (req: Request, res: Response) =>
   }
 });
 
-// Docker Run to Compose converter endpoint
-app.post('/api/convert', async (req: Request, res: Response) => {
+// Docker Run to Compose converter endpoint.
+// Accepts a raw `docker run ...` command and returns the equivalent compose
+// YAML as a string. Authenticated, input-validated, and resilient to
+// composerize throws / malformed output.
+const MAX_DOCKER_RUN_LENGTH = 8192;
+app.post('/api/convert', authMiddleware, async (req: Request, res: Response): Promise<void> => {
+  const { dockerRun } = req.body ?? {};
+  if (typeof dockerRun !== 'string') {
+    res.status(400).json({ error: 'dockerRun must be a string' });
+    return;
+  }
+  const trimmed = dockerRun.trim();
+  if (trimmed.length === 0) {
+    res.status(400).json({ error: 'dockerRun command is required' });
+    return;
+  }
+  if (trimmed.length > MAX_DOCKER_RUN_LENGTH) {
+    res.status(400).json({ error: `dockerRun command is too long (max ${MAX_DOCKER_RUN_LENGTH} characters)` });
+    return;
+  }
+  if (trimmed.includes('\0')) {
+    res.status(400).json({ error: 'dockerRun command contains invalid characters' });
+    return;
+  }
+
+  let yaml: unknown;
   try {
-    const { dockerRun } = req.body;
-    if (!dockerRun || typeof dockerRun !== 'string') {
-      return res.status(400).json({ error: 'dockerRun command is required' });
-    }
-    const yaml = composerize(dockerRun);
-    res.json({ yaml });
+    yaml = composerize(trimmed);
   } catch (error) {
     console.error('Conversion error:', error);
-    res.status(500).json({ error: 'Failed to convert docker run command' });
+    res.status(422).json({ error: 'Could not parse command. Check syntax and supported flags.' });
+    return;
   }
+
+  if (typeof yaml !== 'string' || !yaml.includes('services:')) {
+    console.warn('Converter produced unexpected output for input:', trimmed.slice(0, 200));
+    res.status(422).json({ error: 'Could not parse command. Check syntax and supported flags.' });
+    return;
+  }
+
+  res.json({ yaml });
 });
 
 // Get all containers stats for dashboard.