[madejackson]

Add volume mount read-only, subpath, and volume-nocopy support

This PR adds docker-compose-style volume mount options to Cosmos, delivered as three stacked commits, each self-contained:

1. readOnly + case-insensitive mount key parsing — CosmosMount.ReadOnly (:ro / read_only / readOnly) mapped through create/export, and a case-insensitive unmarshal so mixed spellings such as subPath (capital P) are no longer silently dropped.
2. volume subpaths — mount a directory or a single file inside a named volume:
   • CosmosMount.SubPath → VolumeOptions.Subpath round-tripped through create and export (export now reads HostConfig.Mounts, which preserves the subpath; the top-level Mounts/MountPoint struct has no SubPath field and silently dropped it before).
   • Auto-create missing subpath entries (directories, or a file when the basename contains a dot) inside the volume's mountpoint, mirroring the existing bind-mount folder creation, in both CreateService and EditContainer.
   • Validation that rejects the one combination Docker's volume-subpath cannot handle — a VOLUME mount whose subpath resolves to a FILE with a target nested inside another mount's target directory — with a clear error instead of a cryptic runc ENOTDIR at container start. Plain nested binds and directory subpaths remain allowed.
   • UI: Volumes table gains Subpath and Read-only columns; compose text import parses short-syntax source:target[:subpath][:ro].
3. volume-nocopy — first-class VolumeOptions.NoCopy support:
   • CosmosMount.NoCopy round-tripped end to end, with a NoCopy checkbox in the Volumes table.
   • Workaround gating: moby#52546 — Docker's seed-from-image copy step treats a FILE subpath as a directory and fails at create (open .../safe-mount...: not a directory). moby PR #52584 fixed this daemon-side in Docker Engine 29.5.0, so Cosmos only auto-sets NoCopy on engines older than 29.5.0 (users can still set it explicitly on any engine).

Dependencies

This branch is based on upstream:unstable and includes only the upstream PRs
that touch the same mount/volume code this feature builds on. This PR depends
on them being merged first:

• Depends on fix(mounts): normalize volume field casing to lowercase with backward compatibility #573 — fix/mounts: normalize volume field casing to lowercase
  with backward compat (introduces the CosmosMount type and its
  unmarshal/ToDockerMount helpers — the direct foundation this feature extends)
• Depends on fix(docker): store healthcheck durations as compose-style strings #585 — fix(docker): store healthcheck durations as
  compose-style strings (defines DurationStr, used by the same
  api_blueprint.go/export.go files this PR modifies, and required to build)

Verification

• go build ./... passes
• Unit tests for NoCopy gating and version comparison pass
• vite build passes (frontend)

[cla-bot]

We require contributors to sign our Contributor License Agreement. In order for us to review and merge your code, add yourself to the .clabot file as contributor, as a way of signing the CLA.