fix: Improve log level detection with confidence scoring system

[Akinator31]

What is this PR about?

This PR improves the log type detection system in the Docker logs viewer to significantly reduce false positives. The previous implementation used broad regex patterns that incorrectly flagged informational messages as errors (e.g., "Failed=0" or "0 builds failed").

Technical Approach

The new implementation uses a confidence-based scoring system with three levels of pattern matching:

Level 1 - Structured Patterns (Score: 100pts)

• Highest confidence, no false positives
• Examples: [ERROR], ERROR:, level=error, severity=warning
• Emoji indicators: ⚠️ (warning), ❌ (error), ✅ (success)

Level 2 - Contextual Patterns (Score: 50-70pts)

• Requires full phrases with context
• Examples: "failed to connect", "uncaught exception", "Token exchange failed with status: 400"
• HTTP error codes: 4xx and 5xx status codes
• Stack trace detection: at Object.<anonymous> (/path/file.js:123:45)

Level 3 - Keyword Patterns (Score: 20-30pts)

• Simple keywords with negative context detection
• Only applied if keyword is NOT in phrases like: "did not fail", "without errors", "if failed" (conditional)
• Examples: "exception", "crash", "deprecated" (when used standalone)

How Scoring Works

1. Multiple patterns can match - scores accumulate for each log type
2. Highest score wins - the log type with the most points is selected
3. Defaults to info - if no patterns match, the log is marked as info

Example:

• "⚠️ Token exchange failed with status: 400" scores:

  • Warning: 100pts (⚠️ emoji)
  • Error: 135pts (65pts "failed with" + 70pts "status: 400")
  • Result: Error wins ✅

• "Failed=0 Scanned=1" scores:

  • No patterns match "Failed=0" as it's not a contextual error phrase
  • Result: Info (default) ✅

Key Improvements

• Emoji support: Now detects ⚠️, ❌, ✅ indicators
• HTTP error codes: Properly identifies 4xx/5xx status codes
• Negative context detection: Prevents false positives from phrases like "did not fail"
• Improved contextual matching: "X failed with Y" vs "Failed=0" are now distinguished
• Comprehensive tests: 25 unit tests covering all detection scenarios

This is my proposed approach, but I'm very open to alternative implementations. Feel free to share any suggestions or concerns—I'm happy to adjust based on your feedback.

Checklist

Before submitting this PR, please make sure that:

• [X] You created a dedicated branch based on the canary branch.
• [X] You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• [X] You have tested this PR in your local instance.

Issues related (if applicable)

fixes #1996

Screenshots (if applicable)

Before: Logs like time="2025-11-20T08:19:13Z" level=info msg="Session done" Failed=0 were incorrectly marked as errors

After: These logs are now correctly displayed as info, while real errors like ⚠️ Token exchange failed with status: 400 Bad Request are properly detected