feat(images): add Docker CE images (Debian 13 + Docker, NodeJS 24 + Docker)

[runleveldev]

Summary

Alternative approach to #406: instead of making rootless podman work in guest containers, ship images with the official Docker Engine (CE) preinstalled and grant every LDAP user access to the Docker socket.

• images/docker/ — new Dockerfile installing Docker Engine (CE), CLI, containerd, buildx and compose plugins from Docker's official APT repository. docker.service/docker.socket are enabled at build time.
• One Dockerfile, two images — the base build context is a named context supplied by bake, so:
  • target docker (base = target:base) → Debian 13 + Docker
  • target docker-nodejs (base = target:nodejs) → NodeJS 24 + Docker
• LDAP socket access — membership of the LDAP ldapusers group implies membership of the local docker group via pam_group: the rule *;*;%ldapusers;Al0000-2400;docker in /etc/security/group.conf grants the docker group to LDAP users' sessions at login. Both sides are matched by group name (%ldapusers resolves through NSS/SSSD exactly like the %ldapusers sudoers rule in the base image), so no GID is hardcoded, no local group is created, and the stock docker.socket unit and docker group are untouched. Resolution happens at login time, when SSSD is necessarily up, so there is no boot-ordering concern. pam_group is enabled via pam-auth-update (same mechanism as mkhomedir in base) and acts during pam_setcred, which sshd applies to both password and public-key logins. Socket access is root-equivalent, but ldapusers already hold sudo in these containers (/etc/sudoers.d/ldapusers in base), so no new privilege is granted.
• CI — both targets added to docker-bake.hcl (default group) and build-images.yml (metadata steps, bake files, GHA cache scopes), publishing ghcr.io/mieweb/opensource-server/docker and .../docker-nodejs with the same tag rules as base/nodejs.
• UI — new template entries in ContainerFormPage.tsx: Debian 13 + Docker and NodeJS 24 + Docker.
• Docs — web-gui.md template list and docker-images.md image reference updated.

Validation

• docker buildx bake --print default resolves both new targets with the expected contexts (docker → target:base, docker-nodejs → target:nodejs)
• Workflow YAML parses
• %group syntax in the users field confirmed against group.conf(5)

Notes for review/testing

• dockerd inside an LXC guest requires nesting to be enabled on the Proxmox side.
• Docker version is intentionally unpinned (latest stable from the trixie channel of download.docker.com).
• To verify in a running container: log in over SSH as an LDAP user and check id shows docker, then docker ps.