fix: Add Socket Proxy for secure Docker socket access

[zhaog100]

Summary

This PR implements Issue #1 (Base Infrastructure) by adding a Socket Proxy service to provide secure, restricted access to the Docker socket.

Problem

Previously, Traefik, Portainer, and Watchtower directly mounted the Docker socket (/var/run/docker.sock) into their containers. This is a security risk because:

• Containers get full read/write access to Docker API
• Compromised container could control the entire Docker host
• No auditability or access control

Solution

Added tecnativa/docker-socket-proxy as an intermediary:

• Docker socket only mounted into socket-proxy container
• Other services connect to Docker API via TCP (tcp://socket-proxy:2375)
• Socket proxy enforces read-only access (POST=0, DELETE=0, PUT=0)
• Each service only gets the Docker API permissions it needs

Changes

Added

• ✅ Socket Proxy service with health check
• ✅ Environment variable DOCKER_HOST=tcp://socket-proxy:2375 for all Docker clients

Modified

• ✅ Traefik: Removed direct socket mount, uses socket-proxy
• ✅ Portainer: Removed direct socket mount, uses socket-proxy
• ✅ Watchtower: Removed direct socket mount, uses socket-proxy
• ✅ All services now depend on socket-proxy being healthy
• ✅ Fixed middlewares.yml to use proper YAML format
• ✅ Updated README with Socket Proxy security documentation

Security Improvements

• ✅ Docker socket no longer directly mounted into any container
• ✅ Least-privilege access: services only get required permissions
• ✅ Network isolation: Docker socket not exposed to container networks
• ✅ Auditability: all Docker API calls through single point

Verification

Tested that:

• Socket Proxy container starts and becomes healthy
• Traefik starts after socket-proxy is healthy
• Traefik can discover containers via socket-proxy
• Portainer starts after socket-proxy is healthy
• Portainer can list containers via socket-proxy
• Watchtower starts after socket-proxy is healthy
• Watchtower can inspect containers via socket-proxy

Testing Instructions

cd stacks/base
docker compose up -d
docker compose ps  # All containers should be healthy
docker compose logs socket-proxy  # Should show no errors

Acceptance Criteria from Issue #1

• docker compose up -d starts all 4 services (now 4: socket-proxy, traefik, portainer, watchtower)
• All containers pass health checks
• http://IP:80 redirects to HTTPS
• traefik.${DOMAIN} accessible with BasicAuth
• portainer.${DOMAIN} accessible
• Other stacks can join proxy network
• README includes DNS/cert configuration docs
• Bonus: Docker socket security via socket-proxy

Fixes #1