fix(backup): exclude non-directory bind mounts from volume backups (#728)

[chbndrhnns]

Fixes #728

Problem

When backing up a service via VolumeCopyProducer (or automatic backup mode on non-database services), DockerBackupExecutor.listSources() enumerates all mounts of type volume and bind.

DockerBackupExecutor.streamPath() starts an alpine:3 helper container that mounts each source to /mnt:ro (HostConfig.Binds: ["${source.source}:/mnt:ro"]).

Inside Alpine rootfs, /mnt is a directory. If a container has single-file bind mounts (e.g. nginx.conf, secrets/keys, config files) or Unix domain sockets (e.g. /var/run/docker.sock), runc attempts to bind-mount the host file/socket onto the container directory /mnt, failing with:
OCI runtime create failed ... mount src=..., dst=/mnt ... not a directory
This fatal 400 error crashes the entire backup run for that service.

Solution

1. Filter Non-Directory Bind Mounts in listSources: Add isBackupableSource() in packages/adapters/src/backup/executors/docker.ts to inspect host paths with existsSync() + statSync().isDirectory(). Sockets, FIFOs, and regular single files are excluded from volume backup candidates, while named volumes and directory bind mounts are retained.
2. Handle Both Inspection and DB Fallback: Applied the filter to both live container inspect (data.Mounts) and DB fallback parsing (service.volumes).
3. Tests: Added test cases in packages/adapters/src/backup/executors/docker-list-sources.test.ts asserting that single-file bind mounts and socket mounts are excluded from live container inspection and DB fallback, while directory mounts and named volumes remain intact.