Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/docker-compose/README.md

@@ -0,0 +1,31 @@
+# packages/docker-compose/
+
+Pinned version: see `DOCKER_COMPOSE_VERSION` in [versions.env](../../versions.env).
+
+Not built from source — `docker-compose.SlackBuild` fetches and repackages
+upstream's own prebuilt static x86_64 release binary (`docker/compose`,
+the Go-based Compose v2 CLI plugin — a different project from the older
+Python `podman-compose`). It's a small, purely static ELF with zero
+runtime library dependencies (verified: `ldd` reports "not a dynamic
+executable"), so there's nothing meaningful to gain from a from-source
+build.
+
+`podman compose` (backing the WebUI's Compose panel, see
+`webui/plugins/podman/ajax/compose.php`) has no compose implementation of
+its own — it shells out to an "external compose provider" it discovers by
+searching a fixed list of CLI-plugin directories for a binary named
+`docker-compose`. Without one present, every Compose panel action fails
+outright. Installed to `/usr/local/lib/docker/cli-plugins/docker-compose`
+— one of podman's own search paths (extracted from the pinned podman
+binary: `strings /usr/bin/podman | grep cli-plugins`), chosen specifically
+under `/usr/local/` rather than `/usr/lib/docker/...` so this package
+never collides with (or gets silently shadowed by) a genuine Docker
+installation's own compose plugin on hosts that also run Unraid's
+built-in Docker support.
+
+Found by live-testing the Compose panel end-to-end against a real Unraid
+install: it happened to work only because that particular host already
+had Docker's own `docker-compose` plugin installed from an unrelated,
+pre-existing Docker setup — a clean Unraid install has no compose
+provider at all without this package. See
+[docs/ARCHITECTURE.md, section 5.1](../../docs/ARCHITECTURE.md#51-zu-paketierende-komponenten).

packages/docker-compose/docker-compose.SlackBuild

@@ -0,0 +1,60 @@
+#!/bin/bash
+# =============================================================================
+# packages/docker-compose/docker-compose.SlackBuild
+#
+# Packages the official prebuilt docker/compose v2 release binary — not
+# built from source, see versions.env's DOCKER_COMPOSE_* block for why.
+# `podman compose` (backing webui/plugins/podman/ajax/compose.php) has no
+# compose implementation of its own; it shells out to an "external compose
+# provider" it discovers by searching a fixed list of CLI-plugin
+# directories for a binary literally named `docker-compose` (paths
+# extracted from the pinned podman binary itself:
+# `strings /usr/bin/podman | grep cli-plugins`). Without one present,
+# every Compose panel action fails outright (found by live-testing against
+# a real Unraid install — it only worked there because that host happened
+# to already have Docker's own compose plugin from an unrelated setup).
+#
+# Installed to /usr/local/lib/docker/cli-plugins/docker-compose — one of
+# podman's search paths, deliberately the /usr/local/ one rather than
+# /usr/lib/docker/cli-plugins so this package never collides with (or
+# gets silently shadowed by) a genuine Docker installation's own compose
+# plugin on hosts that also run Unraid's built-in Docker support.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$DOCKER_COMPOSE_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "docker-compose"
+
+binary=$(sb_fetch_and_verify "$DOCKER_COMPOSE_SRC_URL" "$DOCKER_COMPOSE_SRC_SHA256" "docker-compose-$VERSION")
+
+install -D -m 0755 "$binary" "$PKG/usr/local/lib/docker/cli-plugins/docker-compose"
+
+# The release only ships the raw binary (+ checksum/signature files, no
+# LICENSE/README asset) — write minimal doc metadata by hand instead of
+# using sb_install_docs, which expects real files to copy from disk.
+docdir="$PKG/usr/doc/docker-compose-$VERSION"
+mkdir -p "$docdir"
+{
+  echo "docker-compose (docker/compose v2 CLI plugin) $VERSION"
+  echo "https://github.com/docker/compose"
+  echo "Prebuilt static binary, packaged as-is by unraid-podman — see"
+  echo "versions.env for the pinned release URL and SHA256."
+} > "$docdir/README"
+{
+  echo "Built by unraid-podman from upstream's prebuilt release binary."
+  echo "Package: docker-compose $VERSION"
+  echo "Built:   $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+} > "$docdir/unraid-podman.build-info"
+
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"

packages/docker-compose/slack-desc

@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+docker-compose: docker-compose (external Compose provider for podman compose)
+docker-compose:
+docker-compose: The docker/compose v2 CLI-plugin binary, installed as a
+docker-compose: CLI-plugin so `podman compose` can find it. Required by the
+docker-compose: WebUI's Compose panel; packaged from upstream's prebuilt
+docker-compose: static binary release, not built from source.
+docker-compose:
+docker-compose: Homepage: https://github.com/docker/compose
+docker-compose:
+docker-compose:
+docker-compose: