fix(storage): use /host-dev for block device access inside container

Docker always creates a fresh tmpfs at /dev, silently dropping any
/dev:/dev bind mount. Block devices must be accessed via /host-dev
where the host /dev is actually mounted.

Changes:
- docker-compose.yml: /dev:/dev → /dev:/host-dev:rw
- safety.go: add HostDevPath constant + HostDevicePath() helper
- format_linux.go: all device ops (stat, sfdisk, partprobe, mkfs.ext4,
  blkid) use HostDevicePath() to resolve /dev/sdb → /host-dev/sdb
- safety_linux.go: IsSystemDisk() stats device via /host-dev
- scan_linux.go: enrichWithBlkid() probes each partition individually
  via /host-dev/sdXN instead of batch blkid -o export (which can't
  find devices when /dev is Docker's minimal tmpfs)

Fixes "stat /dev/sdb: no such file or directory" in FormatAndMount.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

controller/internal/storage/safety_linux.go

@@ -20,9 +20,9 @@ func IsSystemDisk(devicePath string) (bool, error) {
 		return false, fmt.Errorf("cannot stat /: %w", err)
 	}
 
-	// Get block device info of the target device
+	// Get block device info of the target device (via /host-dev — Docker overrides /dev)
 	var devStat syscall.Stat_t
-	if err := syscall.Stat(devicePath, &devStat); err != nil {
+	if err := syscall.Stat(HostDevicePath(devicePath), &devStat); err != nil {
 		return false, fmt.Errorf("cannot stat %s: %w", devicePath, err)
 	}