fix(storage): use /host-dev for block device access inside container

Docker always creates a fresh tmpfs at /dev, silently dropping any
/dev:/dev bind mount. Block devices must be accessed via /host-dev
where the host /dev is actually mounted.

Changes:
- docker-compose.yml: /dev:/dev → /dev:/host-dev:rw
- safety.go: add HostDevPath constant + HostDevicePath() helper
- format_linux.go: all device ops (stat, sfdisk, partprobe, mkfs.ext4,
  blkid) use HostDevicePath() to resolve /dev/sdb → /host-dev/sdb
- safety_linux.go: IsSystemDisk() stats device via /host-dev
- scan_linux.go: enrichWithBlkid() probes each partition individually
  via /host-dev/sdXN instead of batch blkid -o export (which can't
  find devices when /dev is Docker's minimal tmpfs)

Fixes "stat /dev/sdb: no such file or directory" in FormatAndMount.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

controller/internal/storage/format_linux.go

@@ -36,7 +36,7 @@ func FormatAndMount(req FormatRequest, progress chan<- FormatProgress) (string,
 	if err := ValidateMountName(req.MountName); err != nil {
 		return "", fail("validating", "Érvénytelen csatlakoztatási név", err)
 	}
-	if _, err := os.Stat(req.DevicePath); err != nil {
+	if _, err := os.Stat(HostDevicePath(req.DevicePath)); err != nil {
 		return "", fail("validating", "Az eszköz nem létezik: "+req.DevicePath, err)
 	}
 
@@ -72,20 +72,20 @@ func FormatAndMount(req FormatRequest, progress chan<- FormatProgress) (string,
 		send("partitioning", "Partíció létrehozása...", 15)
 
 		sfdiskInput := "label: gpt\n,,,L\n"
-		cmd := exec.Command("sfdisk", req.DevicePath)
+		cmd := exec.Command("sfdisk", HostDevicePath(req.DevicePath))
 		cmd.Stdin = strings.NewReader(sfdiskInput)
 		if out, err := cmd.CombinedOutput(); err != nil {
 			return "", fail("partitioning", "Partícionálás sikertelen: "+string(out), err)
 		}
 
-		_ = exec.Command("partprobe", req.DevicePath).Run()
+		_ = exec.Command("partprobe", HostDevicePath(req.DevicePath)).Run()
 		time.Sleep(2 * time.Second)
 
 		partDev = req.DevicePath + "1"
 		if strings.Contains(req.DevicePath, "nvme") {
 			partDev = req.DevicePath + "p1"
 		}
-		if _, err := os.Stat(partDev); err != nil {
+		if _, err := os.Stat(HostDevicePath(partDev)); err != nil {
 			return "", fail("partitioning", "Partíció nem található a létrehozás után: "+partDev, err)
 		}
 
@@ -103,7 +103,7 @@ func FormatAndMount(req FormatRequest, progress chan<- FormatProgress) (string,
 		label = label[:16]
 	}
 
-	mkfsCmd := exec.Command("mkfs.ext4", "-L", label, "-F", partDev)
+	mkfsCmd := exec.Command("mkfs.ext4", "-L", label, "-F", HostDevicePath(partDev))
 	var mkfsOut bytes.Buffer
 	mkfsCmd.Stdout = &mkfsOut
 	mkfsCmd.Stderr = &mkfsOut
@@ -120,7 +120,7 @@ func FormatAndMount(req FormatRequest, progress chan<- FormatProgress) (string,
 		return "", fail("mounting", "Csatlakoztatási mappa nem hozható létre: "+mountPath, err)
 	}
 
-	uuidOut, err := exec.Command("blkid", "-s", "UUID", "-o", "value", partDev).Output()
+	uuidOut, err := exec.Command("blkid", "-s", "UUID", "-o", "value", HostDevicePath(partDev)).Output()
 	if err != nil {
 		return "", fail("mounting", "UUID lekérése sikertelen", err)
 	}
@@ -161,7 +161,7 @@ func FormatAndMount(req FormatRequest, progress chan<- FormatProgress) (string,
 
 // GetDeviceUUID returns the UUID of a block device/partition.
 func GetDeviceUUID(devicePath string) (string, error) {
-	out, err := exec.Command("blkid", "-s", "UUID", "-o", "value", devicePath).Output()
+	out, err := exec.Command("blkid", "-s", "UUID", "-o", "value", HostDevicePath(devicePath)).Output()
 	if err != nil {
 		return "", err
 	}