Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webui/plugins/podman/ajax/compose.php

@@ -121,8 +121,19 @@ function compose_status(string $composeDir, string $project): string
     if ($result['exitCode'] !== 0) {
         return 'unknown';
     }
-    $decoded = json_decode($result['output'], true);
-    return (is_array($decoded) && count($decoded) > 0) ? 'up' : 'down';
+    // `podman compose ps --format json` emits one JSON object PER LINE
+    // (JSONL), not a single JSON array — decoding the whole blob in one
+    // json_decode() call fails silently (-> null) as soon as a project has
+    // more than one service (verified live with a 2-service project).
+    // stdout only, too: the "external compose provider" banner goes to
+    // stderr and would otherwise corrupt this either way.
+    $running = 0;
+    foreach (explode("\n", trim($result['stdout'])) as $line) {
+        if (trim($line) !== '' && is_array(json_decode($line, true))) {
+            $running++;
+        }
+    }
+    return $running > 0 ? 'up' : 'down';
 }
 
 function compose_read(string $composeDir, string $project): string
@@ -155,7 +166,7 @@ function compose_run(string $composeDir, string $project, array $subcommand): ar
  * surface even though $project has already been validated above too).
  *
  * @param array<int,string> $subcommand
- * @return array{exitCode:int,output:string}
+ * @return array{exitCode:int,stdout:string,output:string}
  */
 function run_compose_command(string $composeDir, string $project, array $subcommand, int $timeoutSeconds): array
 {
@@ -165,7 +176,7 @@ function run_compose_command(string $composeDir, string $project, array $subcomm
     $descriptors = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
     $process = proc_open($argv, $descriptors, $pipes, $composeDir . '/' . $project);
     if (!is_resource($process)) {
-        return ['exitCode' => 127, 'output' => 'Could not start podman compose process'];
+        return ['exitCode' => 127, 'stdout' => '', 'output' => 'Could not start podman compose process'];
     }
 
     stream_set_timeout($pipes[1], $timeoutSeconds);
@@ -175,5 +186,9 @@ function run_compose_command(string $composeDir, string $project, array $subcomm
     fclose($pipes[2]);
     $exitCode = proc_close($process);
 
-    return ['exitCode' => $exitCode, 'output' => trim($stdout . $stderr)];
+    // 'stdout' (raw) for callers that need to parse machine-readable
+    // output (e.g. compose_status()'s JSON); 'output' (combined,
+    // trimmed) for human-facing success/error messages, where seeing
+    // podman's own stderr banner/warnings is actually useful context.
+    return ['exitCode' => $exitCode, 'stdout' => $stdout, 'output' => trim($stdout . $stderr)];
 }