Discover databases from Docker labels

discovery.py: find the opt-in databases and resolve their settings from bur.* labels on the running container, so there's no dependency on a repo checkout.

• discover() -> [DbTarget] via docker ps --filter label=bur.enable=true and docker inspect. Resolve app (default: container name), database (default: app), user (default: postgres), retention.keep (fallback to the global), and schedule (default: daily).
• Validate label values, since they are attacker-influencable input rather than trusted config. app, database, and user must match ^[a-z0-9][a-z0-9_-]*$ (no path traversal into filenames); bur.path must realpath inside a configured allowlist. Reject anything else with a typed error.
• audit() -> [unlabelled]: running containers whose image matches postgres_image_match but lack bur.enable.

Acceptance

• labels parse into typed targets with defaults applied.
• hostile values are rejected: bur.app=../../etc and a bur.path outside the allowlist both fail loudly.
• audit finds unlabelled postgres containers; tested against mocked docker inspect JSON, with no live Docker.