fix: use imageID in createAndStartContainer (closes #124)

Wire the imageID parameter (returned from docker build) through
createAndStartContainer and buildContainerOptions instead of
reconstructing a mutable tag via fmt.Sprintf.

This ensures containers reference the immutable image digest,
avoiding tag-reuse races when deploys overlap.

Changes:
- Rename _ string to imageID string in createAndStartContainer
- Change buildContainerOptions to accept imageID string instead of deploymentID int64
- Use imageID directly as the Image field in container options
- Update rollback path to pass previousImageID directly
- Add test verifying imageID flows through to container options
- Add database.NewTestDatabase and logger.NewForTest test helpers

internal/service/deploy/export_test.go

@@ -10,6 +10,7 @@ import (
 
 	"git.eeqj.de/sneak/upaas/internal/config"
 	"git.eeqj.de/sneak/upaas/internal/docker"
+	"git.eeqj.de/sneak/upaas/internal/models"
 )
 
 // NewTestService creates a Service with minimal dependencies for testing.
@@ -80,3 +81,12 @@ func (svc *Service) CleanupCancelledDeploy(
 func (svc *Service) GetBuildDirExported(appName string) string {
 	return svc.GetBuildDir(appName)
 }
+
+// BuildContainerOptionsExported exposes buildContainerOptions for testing.
+func (svc *Service) BuildContainerOptionsExported(
+	ctx context.Context,
+	app *models.App,
+	imageID string,
+) (docker.CreateContainerOptions, error) {
+	return svc.buildContainerOptions(ctx, app, imageID)
+}