fix: port api-watchdog mitigation into the real installer compose

The 2026-09-12 CT 101 502 incident fix (api-watchdog: detects the API
container hanging while docker still reports it healthy, and restarts it)
only ever landed in argus-appliance's docker/docker-compose.yml, the
source-build dev compose. It never reached this repo, which is what
update.sh/install.sh on every real Docker-based install actually use --
so the mitigation never shipped to a real install. Ported the service
(built locally from a bundled Dockerfile, since there is no released,
cosign-verified argus-api-watchdog image yet) plus its build context.

docker-compose.yml

@@ -183,6 +183,46 @@ services:
       retries: 3
       start_period: 360s
 
+  # api-watchdog (2026-09-12, see docker/watchdog/README.md in the
+  # argus-appliance repo): closes a real production gap -- `restart:
+  # unless-stopped` above only ever reacts to the api container actually
+  # EXITING. A real incident (CT 101, 2026-09-11/12) had it hang/wedge
+  # internally for ~11 hours while `docker ps` still reported it `Up`; the
+  # HEALTHCHECK above correctly kept detecting the hang the entire time,
+  # but nothing was watching that status and acting on it. This polls the
+  # same already-scoped docker-socket-proxy (zero new grants) and restarts
+  # argus-api after several consecutive unhealthy checks.
+  #
+  # Built locally rather than pulled/pinned/cosign-verified like api/ui/
+  # nginx above: there is not yet a released, signed argus-api-watchdog
+  # image in the registry (tracked as a follow-up to extend ADR-0051's
+  # verification set to a 4th component). The build context ships in this
+  # repo so it stays fully reproducible from source, not a hand-built
+  # local image nobody can regenerate.
+  api-watchdog:
+    build:
+      context: ./watchdog
+    container_name: argus-api-watchdog
+    restart: unless-stopped
+    security_opt:
+      - "no-new-privileges:true"
+    cap_drop:
+      - ALL
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+    environment:
+      WATCHDOG_TARGET_CONTAINER: argus-api
+      WATCHDOG_INTERVAL_SECONDS: "30"
+      WATCHDOG_UNHEALTHY_THRESHOLD: "5"
+    depends_on:
+      docker-socket-proxy:
+        condition: service_started
+      api:
+        condition: service_started
+
   # React UI (Admin Panel), served over HTTPS
   ui:
     # See the api service's own comment above -- same ADR-0051 pinning.