feat: live Docker data — containers, services, logs, metrics via dockerode

- Backend: rewrote containers/services/logs/metrics routes to use dockerode
- docker-compose: mount /var/run/docker.sock, run backend as root
- .drone.yml: sync docker-compose.yml from Gitea on deploy
- Frontend: Containers page shows real data with wired start/stop/restart
- Frontend: Services page shows Docker Compose stacks with health status
- Frontend: Metrics page adds disk (docker df) and containers cards + chart legend
- Frontend: Logs page replaces text input with container dropdown + auto-refresh

frontend/src/App.tsx

@@ -7,11 +7,47 @@ import Services from '@/pages/Services'
 import Logs from '@/pages/Logs'
 import Metrics from '@/pages/Metrics'
 import Settings from '@/pages/Settings'
+import Callback from '@/pages/Callback'
+import { useAuth } from '@/hooks/useAuth'
+
+function AuthGuard({ children }: { children: React.ReactNode }) {
+  const { authenticated, loading } = useAuth()
+  if (loading || !authenticated) {
+    return (
+      <div
+        style={{
+          background: 'hsl(222, 84%, 5%)',
+          height: '100vh',
+          display: 'flex',
+          alignItems: 'center',
+          justifyContent: 'center',
+          color: '#94a3b8',
+          fontFamily: 'system-ui, sans-serif',
+          fontSize: '0.9375rem',
+        }}
+      >
+        {loading ? 'Authenticating…' : 'Redirecting to login…'}
+      </div>
+    )
+  }
+  return <>{children}</>
+}
 
 export default function App() {
   return (
     <Routes>
-      <Route path="/" element={<Layout />}>
+      {/* Public — OIDC callback, no auth required */}
+      <Route path="/callback" element={<Callback />} />
+
+      {/* Protected routes */}
+      <Route
+        path="/"
+        element={
+          <AuthGuard>
+            <Layout />
+          </AuthGuard>
+        }
+      >
         <Route index element={<Dashboard />} />
         <Route path="servers" element={<Servers />} />
         <Route path="containers" element={<Containers />} />