feat: v0.4.0 — welle A (8 new tools: container lifecycle, inspect_image, system_overview)

Closes #1, #4, #6, #7.

Container lifecycle (#1, #7):
- start_container, stop_container, restart_container, pause_container,
  unpause_container — all via SYNO.Docker.Container with JSON-encoded
  name parameter, routed through _resolve_container_name for hash-
  prefix resolution. stop is live-verified; the other four are
  implemented by symmetry on the same API surface.

inspect_image (#4):
- Returns full image detail (layers, env, ports, entrypoint/cmd,
  labels) via SYNO.Docker.Image/get. Accepts name:tag, registry-
  prefixed names, and bare hashes. Defensive response parsing
  handles both wrapped (details.*) and flat envelopes.

system_overview (#6):
- Aggregates CPU %, RAM, network and block I/O across all running
  containers plus running/stopped counts. No new DSM endpoint —
  composed from list + stats, reusing the container_stats CPU
  formula. Per-source errors are non-fatal.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,51 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.4.0] - 2026-05-18
+
+### Added
+
+**Container lifecycle (#1, #7)** — five new tools fill the gap between
+"project" and "exec" operations. Until now the only way to stop or
+restart a single container was to stop the whole project. All five
+use `SYNO.Docker.Container` (version=1) with the same JSON-encoded
+`name` parameter pattern as `delete_container`, and route through
+`_resolve_container_name` so a clean name like `jenkins` resolves
+to DSM's hash-prefixed `f93cb8b504f7_jenkins`:
+
+- `start_container` — start a stopped container (no confirmation).
+- `stop_container` — stop a running container (confirmation required).
+- `restart_container` — stop + start in one call (confirmation required).
+- `pause_container` — SIGSTOP the container's processes (confirmation
+  required).
+- `unpause_container` — SIGCONT the container's processes (no
+  confirmation; reversing a pause is non-destructive).
+
+`stop` is live-verified against DSM; `start`, `restart`, `pause`, and
+`unpause` are implemented by symmetry on the same API surface. If any
+of them turns out to need a different parameter shape in production,
+it will be reverse-engineered via DevTools capture in a follow-up.
+
+**Image inspection (#4)** — `inspect_image` returns the full image
+detail blob (layers + sizes, environment variables, exposed ports,
+entrypoint/cmd, working directory, labels) via
+`SYNO.Docker.Image/get`. Accepts the same identifier forms as
+`delete_image` — `name:tag`, registry-prefixed `ghcr.io/foo/bar:v1`,
+and bare hash — and resolves the user input against `list_images`
+first so typos produce a clean "not found" rather than an opaque DSM
+error. The response parser is defensive about wrapper shape
+(`details.<docker fields>` vs. flat) so the tool keeps working if DSM
+varies the envelope between firmware versions.
+
+**System overview (#6)** — `system_overview` aggregates CPU %, RAM
+used/limit, network I/O, and block I/O across all running containers
+plus running/stopped counts. No new DSM endpoint: composed from
+`SYNO.Docker.Container/list` + `SYNO.Docker.Container/stats`,
+re-using the same Docker-formula CPU calculation as
+`container_stats`. Errors from either upstream call are non-fatal —
+the available section is rendered and the failure is surfaced under a
+`Warnings:` block.
+
 ## [0.3.3] - 2026-05-18
 
 ### Fixed