feat(soc): add Docker container log collection to Promtail + app alert rules

- Mount rootless Docker socket and container log path into Promtail so it
  can discover and tail all application container logs via docker_sd_configs
- Add 3 application-level Grafana alert rules targeting newwhats-backend-prod:
  - BACKEND - Exceção Não Tratada (unhandledRejection, TypeError, etc.)
  - BACKEND - Colisão Prisma P2002 (unique constraint violations)
  - BACKEND - Erros HTTP 5xx (5xx response codes)
- Wire default notification policy to gitea-bridge (was routing to "empty")
- Full self-healing pipeline now covers: infra alerts + application runtime errors

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

soc/docker-compose.yml

@@ -25,6 +25,8 @@ services:
     volumes:
       - /var/log:/var/log:ro
       - /opt/soc/promtail:/etc/promtail:ro
+      - /run/user/1000/docker.sock:/var/run/docker.sock:ro
+      - /home/deploy/.local/share/docker/containers:/home/deploy/.local/share/docker/containers:ro
     command: -config.file=/etc/promtail/config.yml
     networks:
       - soc