fix(preflight): reap timed-out Docker probes

[tang-vu]

Summary

• kill a still-running docker --version process when the preflight probe times out
• await the terminated child so the service does not accumulate zombies
• cover the authenticated HTTP endpoint with a timeout regression test

Why this matters

GET /api/preflight/docker runs during setup and diagnostics. If the Docker CLI hangs, asyncio.wait_for cancels communicate() but does not terminate the operating-system process. Repeated preflight requests can therefore leave blocked Docker clients and unreaped children behind in dashboard-api. The endpoint now owns the complete lifecycle of the subprocess it starts.

Overlap check

Searched open and closed upstream PRs for preflight docker timeout subprocess kill, preflight_docker create_subprocess_exec, and the changed production path in extensions/services/dashboard-api/main.py. No PR covers cleanup of the Docker preflight child. Existing subprocess cleanup changes target different endpoints and services.

Test plan

• python -m pytest -q ods/extensions/services/dashboard-api/tests/test_routers.py (55 passed)
• python -m py_compile ods/extensions/services/dashboard-api/main.py ods/extensions/services/dashboard-api/tests/test_routers.py
• git diff --check

The regression test calls the authenticated /api/preflight/docker boundary, forces the child communication to time out, and verifies both kill() and wait() occur before the timeout response is returned.

Generated with Codex.