refactor(demo): replace Portainer with Dockhand

Replace Portainer container management service with Dockhand:
- Update docker-compose.yml.template with Dockhand service definition
- Replace portainer_data volume with dockhand_data
- Update PORTAINER_PORT to DOCKHAND_PORT in demo.env
- Update all script references (demo-stack.sh, demo-test.sh, validate-all.sh)
- Update integration test from Portainer to Dockhand
- Update documentation files (README.md, AGENTS.md, api-docs,
  service-guides, troubleshooting)

Dockhand provides modern Docker management UI with:
- Container lifecycle management
- Compose stack orchestration
- Git-based deployments
- Multi-environment support
- Terminal access and log streaming
- File browser capabilities

Maintains same port (4007) for consistency.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

demo/docs/api-docs/README.md

@@ -25,15 +25,17 @@ This document provides API endpoint information for all services in the stack.
   - `GET /admin/api.php?list` - Blocked domains list
   - `GET /admin/api.php?summaryRaw` - Raw statistics
 
-### Portainer
+### Dockhand
 - **Base URL**: `http://localhost:4007`
-- **API Version**: v2
-- **Authentication**: Bearer token
-- **Endpoints**:
-  - `POST /api/auth` - Authentication
-  - `GET /api/endpoints` - List endpoints
-  - `GET /api/containers` - List containers
-  - `GET /api/images` - List images
+- **Authentication**: Direct Docker API access
+- **Features**:
+  - Container lifecycle management
+  - Compose stack orchestration
+  - Git-based deployments
+  - Multi-environment support
+  - Terminal access
+  - Log streaming
+  - File browser
 
 ## Monitoring & Observability APIs
 

demo/docs/service-guides/README.md

@@ -18,7 +18,7 @@ All services are accessible through the Homepage dashboard at http://localhost:4
 
 ### 🏗️ Infrastructure Services
 - **Pi-hole** (Port 4006): DNS management with ad blocking
-- **Portainer** (Port 4007): Web-based container management
+- **Dockhand** (Port 4007): Modern Docker management UI
 - **Docker Socket Proxy** (Port 4005): Secure Docker socket access
 
 ### 📊 Monitoring & Observability
@@ -45,7 +45,7 @@ All services are accessible through the Homepage dashboard at http://localhost:4
 - **Username**: `admin`
 - **Password**: `demo_password`
 
-These credentials work for Grafana and Portainer. Other services may have different authentication requirements.
+These credentials work for Grafana and Dockhand. Other services may have different authentication requirements.
 
 ## Getting Help
 

demo/docs/troubleshooting/README.md

@@ -121,18 +121,18 @@ docker compose logs grafana
 # Navigate to: http://localhost:4009/datasources
 ```
 
-#### Portainer Container Access
+#### Dockhand Container Access
 **Symptoms**: Can't manage containers
 **Solution**:
 ```bash
-# Check Docker socket proxy
-docker compose logs docker-socket-proxy
+# Check Dockhand logs
+docker compose logs dockhand
 
-# Verify proxy permissions
-curl http://localhost:4005/version
+# Verify Docker socket access
+docker exec tsysdevstack-supportstack-demo-dockhand docker version
 
-# Restart Portainer
-docker compose restart portainer
+# Restart Dockhand
+docker compose restart dockhand
 ```
 
 ### Performance Issues