refactor(docker): rename OrchestratorService -> DockerInfraService, move to backend/docker

OrchestratorService wasn't the orchestrator — it's the host-side lifecycle of
the docker infra *container* (the one that runs the Orchestrator). It read as
"the orchestrator as a service" and lived in orchestrator/lifecycle.py, while
its siblings (macOS MacosInfraService, Firecracker infra_vm) live under their
backend package. Rename it DockerInfraService and move it to
backend/docker/infra.py alongside the docker backend, with its docker-only
constants (INFRA_*/ORCHESTRATOR_* image + container names, daemon list, mount
paths).

orchestrator/lifecycle.py keeps only the backend-neutral pieces the other infra
services share — DEFAULT_PORT, DEFAULT_STARTUP_TIMEOUT_SECONDS,
OrchestratorStartError, source_hash — which macOS / firecracker / client still
import from there. backend/docker/infra.py imports those (backend -> orchestrator
is an allowed direction). Renamed the unit test to test_docker_infra.py.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_backend_selection.py

@@ -390,10 +390,10 @@ class TestEnsureOrchestrator(unittest.TestCase):
     the orchestrator + gateway containers; firecracker boots the infra VM;
     macos-container starts the infra container."""
 
-    def test_docker_delegates_to_orchestrator_service(self):
+    def test_docker_delegates_to_infra_service(self):
         b = get_bottle_backend("docker")
         with patch(
-            "bot_bottle.orchestrator.lifecycle.OrchestratorService"
+            "bot_bottle.backend.docker.infra.DockerInfraService"
         ) as service_cls:
             service_cls.return_value.ensure_running.return_value = (
                 "http://127.0.0.1:8099"