feat: keep Docker images on computes consistent with the controller host

Only relying on the image name lets a moved tag (e.g. a newer :latest)
silently serve stale content from a compute that already has an image
under the same name. When creating a Docker node, the controller now
pins the image id (Id from the Docker daemon on the controller host)
into the create payload. A compute holding a different image under the
same tag reports the image as missing, which routes it through the
image sync added by the previous commit and re-aligns the tag.

No new template fields or database changes: the controller host daemon
remains the source of truth and the pin is resolved per creation. When
the image is not available on the controller host the pin is omitted
and behavior is unchanged (the compute pulls from the repository).

tests/controller/test_node.py

@@ -726,6 +726,28 @@ async def test_sync_missing_docker_image_pull_fallback(compute, controller):
     compute.post.assert_called_with("/docker/images/pull", data={"image": "nginx:latest"}, timeout=None)
 
 
+@pytest.mark.asyncio
+async def test_create_docker_node_pins_image_digest(compute, controller):
+
+    project = Project(str(uuid.uuid4()), controller=controller)
+    node = Node(project, compute, "demo",
+                node_id=str(uuid.uuid4()),
+                node_type="docker",
+                properties={"image": "gns3/frr:latest", "adapters": 1})
+
+    response = MagicMock()
+    response.status = 200
+    response.json = {}
+    compute.post = AsyncioMagicMock(return_value=response)
+
+    image_id = "sha256:" + "a" * 64
+    with asyncio_patch("gns3server.compute.docker.Docker.query", return_value={"Id": image_id}):
+        assert await node.create() is True
+    # the image id from the controller host daemon is pinned into the create payload
+    data = compute.post.call_args[1]["data"]
+    assert data["image_digest"] == image_id
+
+
 def test_update_label(node):
     """
     The text in label need to be always the