Make Docker Server bootstrap recoverable

[yyjeqhc]

Summary

• replace one-shot .env creation with a recoverable bootstrap state machine: AssetsPrepared -> SecretCommitted -> ContainerStarted -> ServerHealthy -> PairingReady
• write .env and the installation receipt via 0600 temporary files, durable sync, and atomic rename
• add status, resume, and secret-preserving rollback; reconcile the crash window where .env committed but the receipt update did not
• preflight source assets, Compose configuration, host port, and the published image before creating the administrator secret
• wait for the existing Compose healthcheck and explicitly verify /openapi.json before success or pairing-code creation
• accept only a strict HTTPS origin and remove the duplicate weaker URL parser from the generated release prelude
• record compose/source-overlay digests, public origin, env fingerprint, image/mode, and current phase in .webcodex-bootstrap.receipt without storing the token
• preserve .env and the named data volume on post-secret rollback so a partially initialized Server cannot be locked out by token regeneration

Failure/recovery coverage

The bootstrap tests now inject and verify pull failure, missing source overlay/Dockerfile, busy port, docker compose up failure, uncertain up outcome with a surviving container, health failure, pairing failure, env sync failure, receipt sync failure before and after env commit, env fingerprint drift, resume, rollback, unmanaged legacy .env, and strict origin parsing (DNS/IPv4/bracketed IPv6/ports/injection cases).

Validation

• python3 -m unittest scripts.tests.test_server_docker_bootstrap — 20 passed
• bash scripts/test_python_tooling.sh — 78 passed; all 19 Python files syntax-checked
• sh -n deploy/docker/bootstrap.sh
• generated digest-pinned release bootstrap passes sh -n and contains only the canonical runtime URL validator
• python3 scripts/check_markdown_links.py — 44 files, 263 local links, 0 missing
• git diff --check

This is intentionally limited to Docker Server bootstrap/install recovery and its release asset/tests/docs; it does not alter Server auth/connect semantics or the published immutable v0.3.8 assets.