feat: expose container devices to templates

[JamBalaya56562]

Summary

Exposes container device passthrough (HostConfig.Devices) to templates, reimplementing the stale PR #277 against the current internal/ layout.

• Adds a Device{PathOnHost, PathInContainer, Permissions} type and a Devices []Device field on RuntimeContainer.
• Populates it in getContainers, mirroring the existing Mounts loop. go-dockerclient's Device.CgroupPermissions is mapped to Device.Permissions.

Use case: discovering forwarded device nodes (webcams, USB-serial adapters, etc.) from templates.

Notes

• The populate loop iterates the nil-safe local copy of HostConfig (introduced in fix: avoid panic on nil container Config/NetworkSettings/HostConfig #748) instead of dereferencing container.HostConfig directly, so a container inspected with a nil HostConfig cannot panic.
• The unrelated t.Fatal→t.Fatalf churn from the original PR is dropped.
• HostConfig.Devices has been stable in go-dockerclient since 2018, so no dependency change is required.

Tests

Added TestGetContainersDevices, which drives getContainers against a mock daemon returning a device and asserts the populated Devices. Documented the Device struct and a JSON example in the README.

Reimplements #277