fix: best-effort max storage on docker backend

[westbrook-ai]

Description

The docker backend silently ignored the storage field. provision() wired up image, memory_limit, cpu_limit, and env, but never read storage — so per-policy storage and TERMINALS_MAX_STORAGE had no effect on Docker (Kubernetes already sized PVCs correctly).

This wires storage into the container via Docker's StorageOpt, capping the writable layer. Because not every storage driver supports quotas (e.g. overlay2-on-ext4), provisioning falls back gracefully. If the daemon rejects the quota, it logs a warning and retries without it instead of failing.

Caveat documented in the README: StorageOpt limits only the container's writable layer, not the bind-mounted /home/user where user files persist (Docker can't quota a bind mount). For hard per-user storage caps, use a Kubernetes backend.

• terminals/backends/docker.py — apply StorageOpt from storage, with retry-without-quota fallback
• README.md — note on Docker storage-limit behavior and its limits

Verified end-to-end against a live Docker daemon: quota applied (StorageOpt={'size': ...} confirmed via inspect), absent when unset, and fallback retries cleanly on rejection.

Related Issues

Fixes #23

---

Contributor License Agreement

• By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.