feat(docker-watcher): phase 12 - hardening

Blue-green zero-downtime deploys, promote flow validation.
Dual auth: local (bcrypt + JWT) and OAuth2/OIDC (any provider).
Auth middleware, login page, auth settings UI.
Structured logging (slog JSON), config export to YAML.
Graceful shutdown with deploy draining.
Multi-stage Dockerfile and production docker-compose.yml.
Swap phase order: Volumes & Env before UI Polish.

internal/api/instances.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
@@ -103,7 +103,7 @@ func (s *Server) removeInstance(w http.ResponseWriter, r *http.Request) {
 	// Remove the Docker container if it has one.
 	if inst.ContainerID != "" {
 		if err := s.docker.RemoveContainer(r.Context(), inst.ContainerID, true); err != nil {
-			log.Printf("[api] remove container %s: %v", inst.ContainerID, err)
+			slog.Error("remove container", "container_id", inst.ContainerID, "error", err)
 		}
 	}
 
@@ -175,7 +175,7 @@ func (s *Server) controlInstance(w http.ResponseWriter, r *http.Request, action
 
 	// Update status in store.
 	if err := s.store.UpdateInstanceStatus(instanceID, newStatus); err != nil {
-		log.Printf("[api] update instance %s status to %s: %v", instanceID, newStatus, err)
+		slog.Error("update instance status", "instance_id", instanceID, "status", newStatus, "error", err)
 	}
 
 	respondJSON(w, http.StatusOK, map[string]string{