[bug] docker-compose uses 'latest' tags; should use version numbers

[pandafy]

Describe the bug
Using latest tags in docker-compose can cause unwanted upgrades if using docker compose pull instead of make pull (which pulls the correct image and tag them as latest). This may accidentally pull incompatible versions and break a working deployment unexpectedly. This is especially risky for users running older or stable releases (for example, 24.11), because pulling will download newer images (e.g., 25.10.1) without warning.

Steps To Reproduce

1. Deploy using docker-compose for a specific release (e.g., 24.11)
2. Run docker compose pull
3. Docker downloads images tagged as latest (typically the newest release)
4. Deployment may break due to incompatibility or unexpected updates

Expected behavior
Images should always match the intended release version in the compose file, avoiding accidental upgrades or mismatches regardless of command usage.

Screenshots
N/A

System Informatioon:

• OS: Any
• Docker version: Any
• Browser and Browser Version (if applicable): N/A
• Additional context: The workflow currently relies on make pull to determine and overwrite the tags as latest, but this is not a reliable safeguard against accidental upgrades.

[atif09]

ill work on this

Proposed Solution

1) add DOCKER_TAG environment variable

• add DOCKER_TAG=latest to the .env file
• this becomes the single source of truth for image versioning across all workflows
• defaults to latest for backward compatibility

2) update docker-compose.yml

• replace all hardcoded :latest image tags with ${DOCKER_TAG:-latest}

3) update makefiles pull target

• modify from openwisp/$${image}:latest to openwisp/$${image}:${DOCKER_TAG:-latest}
• ensures both make pull and docker compose pull respect the same version