Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/docker-compose/docker-compose.SlackBuild

@@ -0,0 +1,60 @@
+#!/bin/bash
+# =============================================================================
+# packages/docker-compose/docker-compose.SlackBuild
+#
+# Packages the official prebuilt docker/compose v2 release binary — not
+# built from source, see versions.env's DOCKER_COMPOSE_* block for why.
+# `podman compose` (backing webui/plugins/podman/ajax/compose.php) has no
+# compose implementation of its own; it shells out to an "external compose
+# provider" it discovers by searching a fixed list of CLI-plugin
+# directories for a binary literally named `docker-compose` (paths
+# extracted from the pinned podman binary itself:
+# `strings /usr/bin/podman | grep cli-plugins`). Without one present,
+# every Compose panel action fails outright (found by live-testing against
+# a real Unraid install — it only worked there because that host happened
+# to already have Docker's own compose plugin from an unrelated setup).
+#
+# Installed to /usr/local/lib/docker/cli-plugins/docker-compose — one of
+# podman's search paths, deliberately the /usr/local/ one rather than
+# /usr/lib/docker/cli-plugins so this package never collides with (or
+# gets silently shadowed by) a genuine Docker installation's own compose
+# plugin on hosts that also run Unraid's built-in Docker support.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$DOCKER_COMPOSE_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "docker-compose"
+
+binary=$(sb_fetch_and_verify "$DOCKER_COMPOSE_SRC_URL" "$DOCKER_COMPOSE_SRC_SHA256" "docker-compose-$VERSION")
+
+install -D -m 0755 "$binary" "$PKG/usr/local/lib/docker/cli-plugins/docker-compose"
+
+# The release only ships the raw binary (+ checksum/signature files, no
+# LICENSE/README asset) — write minimal doc metadata by hand instead of
+# using sb_install_docs, which expects real files to copy from disk.
+docdir="$PKG/usr/doc/docker-compose-$VERSION"
+mkdir -p "$docdir"
+{
+  echo "docker-compose (docker/compose v2 CLI plugin) $VERSION"
+  echo "https://github.com/docker/compose"
+  echo "Prebuilt static binary, packaged as-is by unraid-podman — see"
+  echo "versions.env for the pinned release URL and SHA256."
+} > "$docdir/README"
+{
+  echo "Built by unraid-podman from upstream's prebuilt release binary."
+  echo "Package: docker-compose $VERSION"
+  echo "Built:   $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+} > "$docdir/unraid-podman.build-info"
+
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"