Reapply "feat(security): enforce service-level access on docker WebSocket handlers"

This reverts commit 56169f3278.

apps/dokploy/server/wss/authorize.ts

@@ -1,5 +1,6 @@
 import { getAccessibleServerIds } from "@dokploy/server";
 import {
+	checkServiceAccess,
 	findMemberByUserId,
 	hasPermission,
 } from "@dokploy/server/services/permission";
@@ -22,6 +23,7 @@ export const canAccessDockerOverWss = async (
 	user: WssUser,
 	session: WssSession,
 	serverId?: string | null,
+	serviceId?: string | null,
 ): Promise<boolean> => {
 	if (!user || !session?.activeOrganizationId) return false;
 
@@ -36,6 +38,18 @@ export const canAccessDockerOverWss = async (
 		if (!accessible.has(serverId)) return false;
 	}
 
+	// When the container belongs to a known Dokploy service (opened from a
+	// service page), enforce service-level access too. Container terminals
+	// opened from the generic Docker overview have no serviceId and fall back to
+	// the docker-permission + server checks above.
+	if (serviceId) {
+		try {
+			await checkServiceAccess(ctx, serviceId, "read");
+		} catch {
+			return false;
+		}
+	}
+
 	return true;
 };