* feat(stacks): add guided first stack import flow
Add an Import mode to the Create Stack dialog and a zero-stacks empty
state so a new user who already has compose files on disk can land their
first stack without reading the docs first.
A read-only scan of the compose directory (GET /api/stacks/import/scan)
lists the compose files it finds with a dry preview of each file's
services, ports, volumes, and env files. Each result is labelled by
placement: already a stack, loose at the root of the compose directory,
or one folder too deep, with the exact path to move misplaced files to.
The scan never writes, moves, or changes any files.
Manual stack creation (Empty, From Git, From Docker Run) is unchanged.
* fix(stacks): read import-scan candidates via a single file handle
Open the compose file once and stat plus read on the same descriptor so
the size check and the read observe the same inode, instead of resolving
the path twice (stat then readFile), which is a time-of-check/time-of-use
race. Mirrors the existing handle-based readers in FileSystemService.
* fix(stacks): confine import scan to the compose dir and refine the empty state
Harden the read-only import scan:
- Resolve symlinks and confirm the real target stays inside the compose
directory before reading a candidate, and reject non-regular files, so a
symlinked compose file or parent cannot expose a file outside the compose
directory through the preview (matches resolveSafeStackPath).
- Read at most the stat-reported size (bounded by the 1 MiB cap) from the open
handle, so a file that grows after the size check cannot exceed the cap.
- Log when the compose directory or a subdirectory cannot be read, so an access
failure is not silently reported as "no compose files found".
Only show the first-run "No stacks yet" prompt when no filter chip is active, so
a filter that matches nothing is not mistaken for an empty fleet.
Anso