Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/catatonit/catatonit.SlackBuild

@@ -0,0 +1,54 @@
+#!/bin/bash
+# =============================================================================
+# packages/catatonit/catatonit.SlackBuild
+#
+# Packages the official prebuilt catatonit release binary — not built from
+# source, see versions.env's CATATONIT_* block for why. catatonit is the
+# init process podman runs inside every pod's infra container to reap
+# zombies; without it, `podman pod create` fails outright with "finding
+# catatonit binary: exec: catatonit: executable file not found in $PATH"
+# (found by live-testing pod creation against a real Unraid install).
+#
+# Installed alongside netavark/aardvark-dns under /usr/libexec/podman/ —
+# podman's helper_binaries_dir search path already covers that directory,
+# matching where the other two helper binaries this project ships already
+# live (see packages/netavark, packages/aardvark-dns).
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$CATATONIT_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "catatonit"
+
+binary=$(sb_fetch_and_verify "$CATATONIT_SRC_URL" "$CATATONIT_SRC_SHA256" "catatonit-$VERSION")
+
+install -D -m 0755 "$binary" "$PKG/usr/libexec/podman/catatonit"
+
+# The release only ships the raw binary (+ checksum/signature files, no
+# LICENSE/README asset) — write minimal doc metadata by hand instead of
+# using sb_install_docs, which expects real files to copy from disk.
+docdir="$PKG/usr/doc/catatonit-$VERSION"
+mkdir -p "$docdir"
+{
+  echo "catatonit $VERSION"
+  echo "https://github.com/openSUSE/catatonit"
+  echo "Prebuilt static binary, packaged as-is by unraid-podman — see"
+  echo "versions.env for the pinned release URL and SHA256."
+} > "$docdir/README"
+{
+  echo "Built by unraid-podman from upstream's prebuilt release binary."
+  echo "Package: catatonit $VERSION"
+  echo "Built:   $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+} > "$docdir/unraid-podman.build-info"
+
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"