chore(deps): migrate Docker client to moby/moby split modules (#748)

The weekly CVE audit flags HIGH CVE-2026-34040 (plus CVE-2026-41567, CVE-2026-42306, and two MEDIUM siblings) on github.com/docker/docker v28.5.2+incompatible in the dblab-server binary. All five live in the Docker daemon; the engine links the module only as an Engine API client. The fix prescribed in #748 (closed) — bump docker/docker to ≥ 29.3.1 — is not possible: that module has no v29 tags. Moby v29 split the monolith into separately versioned submodules, so the remediation is this import migration.

Changes:

• github.com/moby/moby/client v0.5.0 + github.com/moby/moby/api v1.55.0 replace docker/docker; docker/cli is dropped entirely (its only import, cli/streams, replaced by jsonmessage.DisplayStream).
• filters.NewArgs(filters.KeyValuePair{...}) → make(client.Filters).Add(...); cont package helpers pass label strings instead of []filters.KeyValuePair.
• Option structs moved into the client package; methods return Result wrappers — call sites unwrap list.Items, resp.Container, attach.HijackedResponse.
• ContainerExec* → Exec*; ContainerStatsOneShot → ContainerStats (zero options = one-shot, no pre-sample); ContainerCreate takes a single options struct.
• network.PortMap with netip.Addr host IPs replaces nat.PortMap; the embedded UI host config value is now validated via netip.ParseAddr; IPAM gateway read guards .IsValid() to keep the empty-string behavior.
• client.New(client.FromEnv) replaces the removed-in-next-release NewClientWithOpts(FromEnv, WithAPIVersionNegotiation()); negotiation is default-on in the new client and FromEnv still honors DOCKER_HOST/DOCKER_API_VERSION.
• container.Resources.KernelMemory was removed upstream; kernel-memory container config keys are now ignored, test expectations dropped.

Result: go version -m dblab-server lists only moby/moby/{client,api} — the flagged module is out of the shipped binary, so the weekly trivy scan stops matching all five CVEs. docker/docker v28 remains in go.sum as an indirect test-only dependency of testcontainers-go; it never ships. The #748 (closed) acceptance criterion "no +incompatible v28 references in go.sum" holds only for the shipped binary until testcontainers migrates upstream.

Note: moby/moby/client is pre-1.0; its API may still shift before stabilization.

Closes #748 (closed).