feat: v0.4.0 — welle A (8 new tools: container lifecycle, inspect_image, system_overview)

Closes #1, #4, #6, #7.

Container lifecycle (#1, #7):
- start_container, stop_container, restart_container, pause_container,
  unpause_container — all via SYNO.Docker.Container with JSON-encoded
  name parameter, routed through _resolve_container_name for hash-
  prefix resolution. stop is live-verified; the other four are
  implemented by symmetry on the same API surface.

inspect_image (#4):
- Returns full image detail (layers, env, ports, entrypoint/cmd,
  labels) via SYNO.Docker.Image/get. Accepts name:tag, registry-
  prefixed names, and bare hashes. Defensive response parsing
  handles both wrapped (details.*) and flat envelopes.

system_overview (#6):
- Aggregates CPU %, RAM, network and block I/O across all running
  containers plus running/stopped counts. No new DSM endpoint —
  composed from list + stats, reusing the container_stats CPU
  formula. Per-source errors are non-fatal.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -33,16 +33,16 @@ Only a second consecutive failure is treated as a real auth problem.
 
 ---
 
-## Implemented tools (25)
+## Implemented tools (33)
 
 | Category  | Tools |
 |---|---|
 | Projects  | `list_projects`, `get_project_status`, `start_project`, `stop_project`, `redeploy_project`, `create_project`, `delete_project` |
-| Containers | `list_containers`, `get_container_status`, `get_container_logs`, `exec_in_container`, `container_stats`, `delete_container` |
+| Containers | `list_containers`, `get_container_status`, `get_container_logs`, `exec_in_container`, `container_stats`, `delete_container`, `start_container`, `stop_container`, `restart_container`, `pause_container`, `unpause_container` |
 | Compose   | `read_compose`, `update_compose`, `update_image_tag`, `update_env_var` |
-| Images    | `check_image_updates`, `list_images`, `delete_image` |
+| Images    | `check_image_updates`, `list_images`, `delete_image`, `inspect_image` |
 | Networks  | `list_networks`, `create_network`, `delete_network` |
-| System    | `system_df`, `system_prune` |
+| System    | `system_df`, `system_prune`, `system_overview` |
 
 ---
 
@@ -71,7 +71,8 @@ Only a second consecutive failure is treated as a real auth problem.
 - Confirmation required before destructive operations: `stop_project`,
   `redeploy_project`, `create_project`, `delete_project`,
   `exec_in_container`, `update_image_tag`, `update_env_var`,
-  `update_compose`, `delete_container`
+  `update_compose`, `delete_container`, `stop_container`,
+  `restart_container`, `pause_container`
 - After compose changes: suggest `redeploy_project`
 - DSM errors → human-readable message, no stack traces
 - No secrets in stderr output