fix: support host memory accounting for Docker inside LXC

[kmendell]

Checklist

• This PR is not opened from my fork’s main branch
• All new user-facing strings are translated via Paraglide (m.*())

What This PR Implements

Fixes: #3741

Changes Made

Testing Done

AI Tool Used (if applicable)

Additional Context

Disclaimer Greptiles Reviews use AI, make sure to check over its work.

To better help train Greptile on our codebase, if the comment is useful and valid Like the comment, if its not helpful or invalid Dislike

To have Greptile Re-Review the changes, mention greptileai.

Greptile Summary

This PR adds host-memory accounting for Arcane running as Docker inside an LXC guest, integrates it into WebSocket system statistics, and updates the supporting Go modules.

• Resolves the enclosing guest’s cgroup memory usage after validating host cgroup namespace sharing.
• Caches Docker host-memory metadata for 30 seconds while reading current usage for each sample.
• Renames system-stat helpers to follow the repository’s internal-function naming convention.
• Updates backend, CLI, and workspace dependency checksums.

Confidence Score: 4/5

The PR is not yet safe to merge because abbreviated container IDs can disable the intended fix, and the explicit repository testing requirement remains unsatisfied.

The new inspection gate compares a potentially abbreviated detected ID against Docker’s canonical full ID, causing valid deployments to retain incorrect memory statistics; the new platform-specific path also has no regression coverage.

Files Needing Attention: backend/internal/system/memory.go

Prompt To Fix All With AI

### Issue 1
backend/internal/system/memory.go:70
**Short IDs Fail Validation**

When `CurrentContainerID` falls back to a 12-character hostname or mountinfo ID, Docker accepts the abbreviated ID for inspection but returns the canonical 64-character ID. This exact comparison then rejects the current container and silently keeps the incorrect memory baseline that this PR intends to fix. The shared cgroup implementation explicitly permits 12-character IDs in [`cgroup/cgroup.go`](https://github.com/getarcaneapp/sys/blob/HEAD/cgroup/cgroup.go#L393-L440); normalize the detected ID or compare it with the returned full-ID prefix.

### Issue 2
backend/internal/system/memory.go:24-47
**Memory Accounting Lacks Tests**

This adds Docker inspection, cgroup namespace validation, unavailable-total, cancellation, caching, and fallback branches without corresponding tests. The repository's Go testing directive requires new behavior to have table-driven tests, so this requirement must be satisfied before merging. Add coverage for abbreviated IDs, namespace mismatch, Docker errors, invalid totals, and successful host-memory accounting.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix: support host memory accounting for ..." | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

Context used:

• Rule used - # Golang Pro Senior Go developer with deep expert... (source)
• Knowledge Base — Platform operations and reliability

[kmendell]

• fix: support host memory accounting for Docker inside LXC #3846 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Short IDs Fail Validation

When CurrentContainerID falls back to a 12-character hostname or mountinfo ID, Docker accepts the abbreviated ID for inspection but returns the canonical 64-character ID. This exact comparison then rejects the current container and silently keeps the incorrect memory baseline that this PR intends to fix. The shared cgroup implementation explicitly permits 12-character IDs in cgroup/cgroup.go; normalize the detected ID or compare it with the returned full-ID prefix.

Prompt To Fix With AI

This is a comment left during a code review.
Path: backend/internal/system/memory.go
Line: 70

Comment:
**Short IDs Fail Validation**

When `CurrentContainerID` falls back to a 12-character hostname or mountinfo ID, Docker accepts the abbreviated ID for inspection but returns the canonical 64-character ID. This exact comparison then rejects the current container and silently keeps the incorrect memory baseline that this PR intends to fix. The shared cgroup implementation explicitly permits 12-character IDs in [`cgroup/cgroup.go`](https://github.com/getarcaneapp/sys/blob/HEAD/cgroup/cgroup.go#L393-L440); normalize the detected ID or compare it with the returned full-ID prefix.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[arcane-github-automation]

Container images for this PR have been built successfully!

• Manager: ghcr.io/getarcaneapp/manager:pr-3846
• Agent: ghcr.io/getarcaneapp/agent:pr-3846

Built from commit f10a6dd