fix: getNewestContainerId returns null when last-global container is different service

Docker applies -n N globally before label filter, so -n 1 with a service filter
returns empty if the most-recently-created container belongs to a different service.
Remove -n 1; docker ps without it sorts newest-first and the filter correctly
narrows to only the target service's containers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tenant-service/src/main/java/com/xuqm/tenant/service/SystemUpdateService.java

@@ -899,8 +899,12 @@ public class SystemUpdateService {
      */
     private String getNewestContainerId(String service) {
         try {
+            // Do NOT use -n 1: Docker applies -n globally before the label filter,
+            // so if the last-created container is a different service, the filter
+            // returns empty. Without -n, docker ps sorts newest-first and the
+            // label filter returns only this service's containers.
             Process p = new ProcessBuilder(
-                    "docker", "ps", "-a", "-n", "1",
+                    "docker", "ps", "-a",
                     "--filter", "label=com.docker.compose.service=" + service,
                     "--format", "{{.ID}}"
             ).redirectErrorStream(true).start();