Three Docker SDK call sites still passed context.Background() and would hang
Ofelia when the daemon was reachable but wedged (e.g. socket proxy with a
stalled upstream). The audit on PR #611 / issue #608 surfaced them; this
commit completes the cleanup:

| File:Line | Call | Symptom |
| --- | --- | --- |
| web/health.go:checkDocker | Ping, Info | /health and /ready hang; monitoring blind to wedged daemon |
| cli/docker_config_handler.go (NewDockerHandler post-construct + buildSDKProvider) | Ping x2 | Daemon startup hangs at sanity check |
| cli/doctor.go (checkDocker, checkDockerImages) | Ping, HasImageLocally | The diagnostic command meant to surface this hang itself hangs |

Each call is now wrapped in context.WithTimeout(parentCtx, N) with defer-style
cancel:

- 5s for health-check (operators expect responsive monitoring within one
  scrape interval)
- 10s for startup sanity ping (daemon boot is one-shot, generous)
- 5s per call for doctor (per-image, so a slow daemon with many images is not
  falsely failed by a single overall budget)

Note: web/health.go's checkDocker runs from the periodic ticker, not the
HTTP handler, so the parent context is context.Background() rather than
r.Context() as the issue text suggested. The HTTP handlers read pre-computed
cached state and never call into Docker themselves.

Also fixes a closely-related fourth unbounded Ping at NewDockerHandler's
own post-construction sanity check (same construction-time wedge, two lines
of code apart). Tracked as part of #614 because the audit's interpretation
of the issue covered both Pings.

Plumbs SDKDockerProviderConfig.NegotiateTimeout to forward the test-friendly
negotiation bound from #611 one layer up, so the construction-time tests can
run in seconds instead of waiting on the 30s default. Adds a
newSDKDockerProvider package-level factory so tests can swap in a hanging
stub - mirrors the existing newDockerHandler seam.

Tests: each fix site has a regression test that exercises the wedge with a
hanging mock provider (parallel-safe - no t.Setenv, no env var contamination
per PR #606 review feedback) and asserts the call returns within the bounded
window. Each test was confirmed to fail (test timeout fires) on the pre-fix
code and pass on the fixed code.

Fixes #614

Signed-off-by: Sebastian Mendel <[email protected]>

- buildSDKProvider now derives its bounded ping ctx from c.ctx (not
  context.Background) so SIGINT during startup also cancels the sanity
  ping (code review IMPORTANT).
- Bump expectWithin in startup-ping tests from 15s -> 20s for CI
  scheduling headroom (test review nit; spec was 10s timeout, 2x floor).
- TROUBLESHOOTING: new "Docker Daemon Wedged" entry covering the new
  behaviour — what used to be an indefinite hang is now a loud
  context-deadline failure (DX review gap).
- CHANGELOG: clarify that timeouts are unexported constants, document
  the per-call vs overall trade-off in doctor's HasImageLocally, and
  note c.ctx propagation (DX + code review notes).

Signed-off-by: Sebastian Mendel <[email protected]>