Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/build-packages.sh

@@ -2,10 +2,11 @@
 # =============================================================================
 # scripts/build-packages.sh
 #
-# Orchestrates building all seven Slackware .txz packages this plugin ships
-# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs), by
-# running each package's <name>.SlackBuild in turn. See
-# docs/ARCHITECTURE.md section 5.2 (Build-Strategie).
+# Orchestrates building all Slackware .txz packages this plugin ships
+# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs,
+# catatonit, nftables, docker-compose), by running each package's
+# <name>.SlackBuild in turn. See docs/ARCHITECTURE.md section 5.2
+# (Build-Strategie).
 #
 # This script itself does not containerize anything — it assumes it is
 # already running inside a Slackware-compatible build environment (see
@@ -37,13 +38,17 @@ DIST_DIR="$REPO_ROOT/dist"
 # see packages/unraid-podman/README.md) is built last since it's by far the
 # fastest and has nothing useful to report on failure that earlier package
 # failures wouldn't already explain.
-ALL_PACKAGES=(conmon crun netavark aardvark-dns passt fuse-overlayfs podman unraid-podman)
+ALL_PACKAGES=(catatonit nftables docker-compose conmon crun netavark aardvark-dns passt fuse-overlayfs podman unraid-podman)
 
-# Podman is listed second-to-last on purpose: among the seven upstream
-# components it is the slowest build and the one most likely to fail on a
-# dependency/tag mistake, so faster packages surface problems first during
-# local iteration. unraid-podman is genuinely last since it packages this
-# repo's own files and has no compile step at all.
+# catatonit, nftables, and docker-compose are listed first since they're
+# all a plain fetch-and-repackage of an already-built upstream artifact
+# (see their own README.md for why) — no compiler, fastest possible
+# signal if their pinned URL/checksum in versions.env ever goes stale.
+# Podman is listed second-to-last on purpose: among the compiled
+# components it is the slowest build and the one most likely to fail on
+# a dependency/tag mistake, so faster packages surface problems first
+# during local iteration. unraid-podman is genuinely last since it
+# packages this repo's own files and has no compile step at all.
 
 requested=("$@")
 if [ "${#requested[@]}" -eq 0 ]; then

scripts/ci/setup-slackware-buildenv.sh

@@ -3,7 +3,7 @@
 # scripts/ci/setup-slackware-buildenv.sh
 #
 # Prepares a Slackware container (see .github/workflows/build-packages.yml)
-# to build all seven packages under packages/. Idempotent and safe to re-run.
+# to build all eleven packages under packages/. Idempotent and safe to re-run.
 #
 # Strategy: vbatts/slackware:15.0 (the image build-packages.yml runs this
 # in) is a minimal rootfs — it ships none of the 'D' (development) series,

scripts/lib/slackbuild-common.sh

@@ -6,8 +6,9 @@
 # Centralizing this logic means each individual SlackBuild only has to
 # describe *how to compile* its component — fetching, checksum verification,
 # and final .txz packaging are implemented once, here, and used the same way
-# by all seven packages. This is what keeps the seven build scripts
-# consistent and short instead of each reinventing (and potentially
+# by all ten packages (unraid-podman's own SlackBuild has no upstream
+# source to fetch, so it doesn't need this). This is what keeps the build
+# scripts consistent and short instead of each reinventing (and potentially
 # forgetting) checksum verification or Slackware package metadata.
 #
 # Every SlackBuild is expected to:

scripts/release.sh

@@ -4,7 +4,7 @@
 #
 # Cuts a release of the plugin itself:
 #   1. Bumps the &version; entity in plugin/podman.plg to <new-version>.
-#   2. Builds all seven packages (scripts/build-packages.sh) unless
+#   2. Builds all eleven packages (scripts/build-packages.sh) unless
 #      SKIP_BUILD=1 is set (useful when CI already built them in a prior job
 #      and only wants this script to do the .plg/CHANGELOG bookkeeping).
 #   3. Verifies + consolidates checksums (scripts/checksums.sh).
@@ -54,10 +54,12 @@ RELEASE_BASE_URL="https://github.com/$REPO_SLUG/releases/download/$RELEASE_TAG"
 
 # Component name -> the entity name prefix used in podman.plg. Must match
 # plugin/podman.plg's <!ENTITY NAME_txz_...> declarations exactly.
-# unraid-podman is the plugin's own scaffolding package (see
-# packages/unraid-podman/README.md), not an upstream component, but it's
-# released and entity-updated exactly like the other seven.
-COMPONENTS=(podman conmon crun netavark aardvark-dns passt fuse-overlayfs unraid-podman)
+# catatonit, nftables, and docker-compose are vendored runtime
+# dependencies (not built from source, see their own packages/*/README.md)
+# and unraid-podman is the plugin's own scaffolding package (see
+# packages/unraid-podman/README.md), not an upstream component, but all
+# four are released and entity-updated exactly like the seven upstream ones.
+COMPONENTS=(podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables docker-compose unraid-podman)
 
 echo "==> Releasing unraid-podman plugin v$NEW_VERSION (packages tag: $RELEASE_TAG)"