Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plugin/sbin/podman-verify-packages.sh

@@ -2,7 +2,7 @@
 # =============================================================================
 # plugin/sbin/podman-verify-packages.sh
 #
-# "Pakete prüfen" — verifies the seven packages this plugin ships are
+# "Pakete prüfen" — verifies the eleven packages this plugin ships are
 # actually installed, at the version the plugin expects, and that the
 # backed-up .txz copies (see podman-backup.sh) haven't bit-rotted on disk.
 #
@@ -34,7 +34,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 . "$SCRIPT_DIR/podman-common.sh"
 
 INSTALLED_VERSIONS_FILE="/usr/local/share/unraid-podman/installed-versions.env"
-PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs unraid-podman"
+PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables docker-compose unraid-podman"
 
 QUIET=0
 [ "${1:-}" = "--quiet" ] && QUIET=1
@@ -95,7 +95,7 @@ for name in $PACKAGES; do
   esac
 
   # --- Check 3: backup artifact integrity, if present --------------------
-  # Packages of all 7 components released together as one plugin version
+  # Packages of all components released together as one plugin version
   # are grouped under a single PLUGIN_VERSION directory (not per-component
   # version) — a rollback targets "go back to plugin release X", matching
   # podman-backup.sh's restore-packages <plugin-version>.