fix(infra): restrict Docker API proxy to whitelist only

infra/dashboard/nginx.conf

@@ -66,13 +66,26 @@ http {
             proxy_read_timeout 5s;
         }
 
-        # Docker API proxy (read-only Unix socket)
+        # Docker API proxy — strict whitelist (read-only Unix socket)
-        location /api/docker/ {
+        # Uses exact match (=) to avoid regex+proxy_pass URI limitation.
-            proxy_pass http://unix:/var/run/docker.sock:/;
+        location = /api/docker/containers/json {
+            proxy_pass http://unix:/var/run/docker.sock:/containers/json;
             proxy_set_header Host $host;
             proxy_read_timeout 10s;
         }
 
+        location = /api/docker/version {
+            proxy_pass http://unix:/var/run/docker.sock:/version;
+            proxy_set_header Host $host;
+            proxy_read_timeout 10s;
+        }
+
+        # Deny all other Docker API access
+        location /api/docker/ {
+            deny all;
+            return 403;
+        }
+
         # Static files
         location / {
             try_files $uri $uri/ /index.html;