feat(docker-watcher): phases 3+4 - Docker client & NPM client

Phase 3: Docker Engine API wrapper — pull/inspect images, container
lifecycle (create/start/stop/remove/restart), network management,
label-based container tracking, deterministic naming.

Phase 4: Nginx Proxy Manager API client — JWT auth with auto-refresh,
CRUD for proxy hosts, domain-based host lookup.

internal/docker/network.go

@@ -0,0 +1,53 @@
+package docker
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/network"
+)
+
+// EnsureNetwork creates a Docker network with the given name if it does not
+// already exist. It returns the network ID in all cases.
+func (c *Client) EnsureNetwork(ctx context.Context, networkName string) (string, error) {
+	// Check if the network already exists.
+	filterArgs := filters.NewArgs()
+	filterArgs.Add("name", networkName)
+
+	networks, err := c.api.NetworkList(ctx, network.ListOptions{
+		Filters: filterArgs,
+	})
+	if err != nil {
+		return "", fmt.Errorf("list networks for %s: %w", networkName, err)
+	}
+
+	// NetworkList with a name filter may return partial matches, so check exact name.
+	for _, n := range networks {
+		if n.Name == networkName {
+			return n.ID, nil
+		}
+	}
+
+	// Create the network.
+	resp, err := c.api.NetworkCreate(ctx, networkName, network.CreateOptions{
+		Driver: "bridge",
+		Labels: map[string]string{
+			LabelProject: "docker-watcher",
+		},
+	})
+	if err != nil {
+		return "", fmt.Errorf("create network %s: %w", networkName, err)
+	}
+
+	return resp.ID, nil
+}
+
+// ConnectNetwork attaches a container to an existing network.
+func (c *Client) ConnectNetwork(ctx context.Context, networkID string, containerID string) error {
+	err := c.api.NetworkConnect(ctx, networkID, containerID, &network.EndpointSettings{})
+	if err != nil {
+		return fmt.Errorf("connect container %s to network %s: %w", containerID, networkID, err)
+	}
+	return nil
+}