fix: support relative bind mounts from agent containers

[alex289]

Summary

• add optional HOST_DEPLOYMENTS_DIR configuration for host-visible deployment paths
• translate deployment-local bind mount sources before deploys and image-update redeploys
• keep bind-mount restrictions aligned with the translated host path
• document the setting in the production and development Compose examples

Root cause

Compose resolves relative bind mount sources inside the OrcaCD agent container, for example to /deployments/<app>/data. The Docker daemon runs on the host and interprets bind sources in the host filesystem, so that container-internal path is not valid there.

Impact

Applications can use convenient relative mounts such as ./data:/app/data while their files remain directly accessible on the host below the configured deployment directory.

Validation

• go test -race ./internal/agent -count=1
• go test -race ./internal/agent/docker -run 'TranslateBindMountSources|Deploy_(TranslatesBindMountForAllowlistedApplication|RestrictMountsAllowsTranslatedDeploymentBind)|CheckAndPullImages_TranslatesBindMountBeforeUp' -count=1
• go test ./... -run '^$'
• git diff HEAD^ HEAD --check

The full Docker-daemon-backed test suite was not rerun during publishing; the focused regression tests and repository-wide Go compilation pass.

Possibly fixes #231

[codecov]

Codecov Report

❌ Patch coverage is 71.05263% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/agent/docker/mounts.go	72.72%	3 Missing and 3 partials ⚠️
backend/internal/agent/docker/deploy.go	50.00%	1 Missing and 1 partial ⚠️
backend/internal/agent/docker/images.go	0.00%	1 Missing and 1 partial ⚠️
backend/internal/agent/agent.go	87.50%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!