Auto-clear removal block after successful Docker host stop

When a Docker host successfully completes a stop command and confirms
it has disabled itself, automatically clear the removal block to allow
immediate re-enrollment.

This fixes the UX issue where users who remove a Docker host cannot
immediately reinstall it with a new token, as the host ID remains
blocked for 24 hours. The block is still needed to prevent zombie
reports from stale agents, but once the agent confirms it stopped
successfully, there's no need to keep the block.

Changes:
- Clear removal block in HandleCommandAck after successful host removal
- Allows remove → reinstall workflow without manual intervention
- Block remains for forced removals or offline hosts (as intended)

internal/api/docker_agents.go

@@ -170,6 +170,12 @@ func (h *DockerAgentHandlers) HandleCommandAck(w http.ResponseWriter, r *http.Re
 	if shouldRemove {
 		if _, removeErr := h.monitor.RemoveDockerHost(hostID); removeErr != nil {
 			log.Error().Err(removeErr).Str("dockerHostID", hostID).Str("commandID", commandID).Msg("Failed to remove docker host after command completion")
+		} else {
+			// Clear the removal block since the agent has confirmed it stopped successfully.
+			// This allows immediate re-enrollment without waiting for the 24-hour TTL.
+			if reenrollErr := h.monitor.AllowDockerHostReenroll(hostID); reenrollErr != nil {
+				log.Warn().Err(reenrollErr).Str("dockerHostID", hostID).Msg("Failed to clear removal block after successful stop")
+			}
 		}
 	}