Fix Docker apply crash and add safe profile test flow

Remove invalid _mirror_manager from daemon.json that prevented Docker from starting. Add 2-minute test apply with auto-rollback, final apply confirmation, emergency-restore CLI/UI, and post-restart Docker health checks.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/services/backup.py

@@ -7,6 +7,7 @@ from datetime import datetime
 from pathlib import Path
 
 from app.config import Config
+from app.services.docker_svc import sanitize_daemon_json_file
 from app.services.host import host_path, run_on_host
 
 logger = logging.getLogger(__name__)
@@ -147,12 +148,37 @@ def restore_backup(backup_root: Path | str) -> dict:
     elif dropin.exists():
         dropin.unlink()
 
+    daemon_path = host_path("etc/docker/daemon.json")
+    if sanitize_daemon_json_file(daemon_path):
+        results.append("پاکسازی کلیدهای نامعتبر daemon.json")
+
     run_on_host(["systemctl", "restart", "systemd-resolved"])
-    run_on_host(["systemctl", "restart", "docker"])
+    docker_result = run_on_host(["systemctl", "restart", "docker"], timeout=120)
+    if docker_result.returncode != 0:
+        return {
+            "success": False,
+            "error": (docker_result.stderr or "خطا در restart docker")[:500],
+            "restored": results,
+        }
 
     return {"success": True, "restored": results}
 
 
+def get_latest_apply_backup() -> Path | None:
+    """Return the most recent before_apply backup directory, if any."""
+    if not Config.BACKUP_DIR.exists():
+        return None
+    candidates = sorted(
+        (
+            p
+            for p in Config.BACKUP_DIR.iterdir()
+            if p.is_dir() and "before_apply" in p.name
+        ),
+        reverse=True,
+    )
+    return candidates[0] if candidates else None
+
+
 def create_initial_backup() -> Path:
     return create_backup("initial")