Add LXC Docker capability support via LXCAP sidecar

Summary

• Proxmox's API has no writable path for the lxc.cap.drop config line an unprivileged LXC container needs for Docker support, so this adds a small per-node LXCAP sidecar client (internal/lxcap) and wires it into the existing NetBox -> diff -> apply pipeline.
• NetBox's docker_enabled custom field drives a new enable_docker_cap Plan action (LXC-only, offered once the container already exists — a brand-new LXC gets it on its next apply after creation, same two-step pattern as every other post-create action).
• A request to disable (docker_enabled flips back to false while still live) is flagged with a non-blocking "disable it manually" warning rather than attempted, since LXCAP has no delete call yet.
• LXCAP base URL/token are configured per-node on the same /settings/proxmox environment row as the Proxmox API URL/token (new lxcap_url/lxcap_token columns).

Test plan

• go build ./...
• go vet ./...
• go test ./... -count=1 (new unit tests for internal/lxcap, boolField, diff.collectDockerCapAction, apply's LXCAP dispatch, plus an end-to-end web test driving GET device page -> POST apply and asserting LXCAP's Enable is called with the right vmid)