chore: add Coolify Docker cleanup script

STATE.md

@@ -185,6 +185,9 @@ As of 2026-07-29:
 - Prefer small targeted file reads with `rg` and narrow ranges.
 - Deployment status polling should be sparse. Coolify rebuilds can take 7-11 minutes
   because the Docker build currently runs without cache and reinstalls system deps.
+- LXC 105 Docker cleanup: old app images can be removed safely because rollback
+  is by git SHA + rebuild. Use `scripts/coolify_docker_cleanup.sh`; it removes
+  only unused Coolify app images for FN-8/RAA and never prunes Docker volumes.
 - Avoid dumping long post texts from DB unless explicitly needed.
 - For runtime checks, use the current Coolify/Gitea/LXC 105 path from `D:\DEVELOPMENT\.infra.md`.
 - Do not `git reset --hard` or revert user/server hotfixes.

scripts/coolify_docker_cleanup.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+set -eu
+
+# Safe cleanup for the Coolify Docker destination.
+# Removes old app images that are not used by running containers.
+# Volumes are intentionally never pruned: they hold Postgres/app data.
+
+KEEP_PER_REPO="${KEEP_PER_REPO:-1}"
+CONTAINER_UNTIL="${CONTAINER_UNTIL:-24h}"
+BUILDER_UNTIL="${BUILDER_UNTIL:-24h}"
+
+if [ "$#" -gt 0 ]; then
+  REPOS="$*"
+else
+  REPOS="n6cnr60anmruiwkiey0pukye korokrhpoyqxf0nw2y8vk7lp"
+fi
+
+used_images="$(docker ps --format '{{.Image}}' | sort -u)"
+
+for repo in $REPOS; do
+  count=0
+  docker image ls "$repo" --format '{{.Repository}}:{{.Tag}} {{.ID}}' |
+  while read -r image image_id; do
+    [ -n "$image" ] || continue
+    if printf '%s\n' "$used_images" | grep -qx "$image"; then
+      count=$((count + 1))
+      echo "keep running image: $image"
+      continue
+    fi
+
+    count=$((count + 1))
+    if [ "$count" -le "$KEEP_PER_REPO" ]; then
+      echo "keep recent image: $image"
+      continue
+    fi
+
+    echo "remove old image: $image"
+    docker rmi "$image_id" || true
+  done
+done
+
+docker container prune -f --filter "until=$CONTAINER_UNTIL"
+docker image prune -f
+docker builder prune -f --filter "until=$BUILDER_UNTIL"