Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/docker-compose/README.md

@@ -0,0 +1,31 @@
+# packages/docker-compose/
+
+Pinned version: see `DOCKER_COMPOSE_VERSION` in [versions.env](../../versions.env).
+
+Not built from source — `docker-compose.SlackBuild` fetches and repackages
+upstream's own prebuilt static x86_64 release binary (`docker/compose`,
+the Go-based Compose v2 CLI plugin — a different project from the older
+Python `podman-compose`). It's a small, purely static ELF with zero
+runtime library dependencies (verified: `ldd` reports "not a dynamic
+executable"), so there's nothing meaningful to gain from a from-source
+build.
+
+`podman compose` (backing the WebUI's Compose panel, see
+`webui/plugins/podman/ajax/compose.php`) has no compose implementation of
+its own — it shells out to an "external compose provider" it discovers by
+searching a fixed list of CLI-plugin directories for a binary named
+`docker-compose`. Without one present, every Compose panel action fails
+outright. Installed to `/usr/local/lib/docker/cli-plugins/docker-compose`
+— one of podman's own search paths (extracted from the pinned podman
+binary: `strings /usr/bin/podman | grep cli-plugins`), chosen specifically
+under `/usr/local/` rather than `/usr/lib/docker/...` so this package
+never collides with (or gets silently shadowed by) a genuine Docker
+installation's own compose plugin on hosts that also run Unraid's
+built-in Docker support.
+
+Found by live-testing the Compose panel end-to-end against a real Unraid
+install: it happened to work only because that particular host already
+had Docker's own `docker-compose` plugin installed from an unrelated,
+pre-existing Docker setup — a clean Unraid install has no compose
+provider at all without this package. See
+[docs/ARCHITECTURE.md, section 5.1](../../docs/ARCHITECTURE.md#51-zu-paketierende-komponenten).