Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webui/plugins/podman/ajax/volumes.php

@@ -9,7 +9,7 @@
  *
  * Actions (?action=...):
  *   list     GET  -> normalized volume list, with usedBy counts
- *   create   POST {"name": "...", "driver": "local"}
+ *   create   POST {"name": "...", "driver": "local", "path": "/mnt/cache/..." (optional)}
  *   remove   POST {"name": "...", "force": false}
  */
 
@@ -30,7 +30,11 @@ switch ($action) {
         if ($name === '') {
             podman_json_error('Missing name in request body', 400);
         }
-        podman_json_response($client->createVolume($name, (string) ($body['driver'] ?? 'local')));
+        $path = trim((string) ($body['path'] ?? ''));
+        if ($path !== '' && !str_starts_with($path, '/')) {
+            podman_json_error("Host path ({$path}) must be an absolute path.", 400);
+        }
+        podman_json_response($client->createVolume($name, (string) ($body['driver'] ?? 'local'), $path !== '' ? $path : null));
         break;
 
     case 'remove':
@@ -65,10 +69,19 @@ function volumes_list(PodmanClient $client): array
     $out = [];
     foreach ($raw as $v) {
         $name = (string) ($v['Name'] ?? '');
+        $options = $v['Options'] ?? [];
+        // A volume created with our "Host path" field carries
+        // type=none,o=bind,device=<path> (see PodmanClient::createVolume)
+        // — surfaced separately from 'mountpoint' (podman's own internal
+        // storage path, which stays populated even for bind-backed
+        // volumes) so the UI can show users the host path they actually
+        // asked for.
+        $hostPath = (is_array($options) && ($options['o'] ?? '') === 'bind') ? (string) ($options['device'] ?? '') : null;
         $out[] = [
             'name' => $name,
             'driver' => (string) ($v['Driver'] ?? 'local'),
             'mountpoint' => (string) ($v['Mountpoint'] ?? ''),
+            'hostPath' => $hostPath,
             'createdAt' => podman_parse_time($v['CreatedAt'] ?? null),
             'usedBy' => $usageCounts[$name] ?? 0,
         ];