Bound the watchdogs' docker calls — a hung daemon is what they exist to catch

Watchdogs/System/network_watchdog.sh

@@ -285,7 +285,7 @@ if [[ -n "$DDNS_DOMAIN" ]] && [[ -n "$DDNS_CONTAINER" ]]; then
             warn "DRY RUN — would restart $DDNS_CONTAINER"
         else
             warn "Restarting $DDNS_CONTAINER to trigger Cloudflare update..."
-            if docker restart "$DDNS_CONTAINER" >/dev/null 2>&1; then
+            if timeout "$DOCKER_TIMEOUT" docker restart "$DDNS_CONTAINER" >/dev/null 2>&1; then
                 warn "$DDNS_CONTAINER restarted ✅"
                 notify "DDNS mismatch on $(hostname) ($MY_ID) — $DDNS_DOMAIN was $DNS_IP, public is $PUBLIC_IP — $DDNS_CONTAINER restarted" \
                     "Network Watchdog" "warning"
@@ -342,7 +342,7 @@ if [[ -n "$NPM_URL" ]]; then
             if [[ "$DRY_RUN" == true ]]; then
                 warn "DRY RUN — would restart NginxProxyManager"
             else
-                if docker restart NginxProxyManager >/dev/null 2>&1; then
+                if timeout "$DOCKER_TIMEOUT" docker restart NginxProxyManager >/dev/null 2>&1; then
                     warn "NginxProxyManager restarted ✅"
                     set_strikes "npm" 0 "${NETWORK_WATCHDOG_NPM_STATE_FILE}"
                     notify "NPM proxy restarted on $(hostname) ($MY_ID) — $NPM_URL was unreachable for $NPM_STRIKES cycles" \