chore(deps): retire docker/docker via gormx migration (Aikido)

[dorothyyzh]

Status: DRAFT — depends on qor5/x#582. The pseudo-version will be re-pointed to a release tag before this is marked ready. Do not merge yet.

Summary

Replace github.com/theplant/testenv usage in four _test.go files with qor5/x/v3/gormx.OpenContainer + plain gorm.Open. Bump qor5/x/v3 to the #582 branch pseudo-version.

Why

docker/docker is frozen at v28.5.2+incompatible on the Go module proxy — moby moved Go-module publishing to github.com/moby/moby/api. Aikido flags docker/docker for CVE-2026-33997 / 34040 (group 25543337).

theplant/testenv@v0.2.1 (HEAD, unreleased for ~10 months) directly imports docker/docker/api/types/container and was the last transitive path bringing docker/docker into this module's go.mod. qor5/x already migrated its equivalent helper (gormx.OpenContainer) off docker/docker onto github.com/moby/moby/api in qor5/x#581.

theplant/relay is a foundational library used across theplant/* services (including qor5/admin), so retiring docker/docker here unblocks downstream services.

Changes

• gormrelay/relay_test.go, protorelay/proto_test.go, filter/gormfilter/filter_test.go: replace testenv.New().DBEnable(true).SetUp() with gormx.OpenContainer(ctx, nil) + gorm.Open(postgres.Open(container.DSN), …).
• filter/gormfilter/perf/perf_test.go: same swap, but only in the else branch (the --dsn flag branch was already using plain gorm.Open).
• go.mod: bump qor5/x/v3 to PR #582 pseudo-version, drop theplant/testenv, transitively bump testcontainers-go 0.38.0 → 0.42.0 (first moby-migrated release).

Why gormx.OpenContainer rather than gormx.SetupDatabase

SetupDatabase installs OmitAssociationsPlugin globally on the returned *gorm.DB, which omits GORM associations on every Create/Update/Delete. The gormrelay and gormfilter tests exercise associations (Country↔Company↔User chains), so this side effect would silently break them. The lighter OpenContainer + plain gorm.Open mirrors the prior testenv behavior 1:1.

Verification

• go build ./... clean
• go vet ./... clean
• go test ./... pass (all 8 packages with tests, ~22s — cursor, filter, filter/gormfilter, filter/gormfilter/perf, filter/protofilter, gormrelay, internal/hook, protorelay)
• go mod why github.com/docker/docker → (main module does not need package github.com/docker/docker)
• docker/docker no longer in go.mod
• theplant/testenv no longer in go.mod

Merge plan

1. Merge qor5/go-bus#20 → tag
2. Merge theplant/ratelimiter#14 → tag
3. Merge qor5/x#582 (after step 1–2, re-pointed to tags) → tag
4. Re-point this PR's qor5/x/v3 to the qor5/x release tag
5. Mark ready for review and merge → tag
6. Downstream: qor5/admin bumps qor5/x + theplant/relay

Deployment note

Skill opens this PR; it does not touch any release-* branch.