Add catatonit/nftables/docker-compose packages, fix CSRF/streaming/storage bugs found by live testing

- Package #9-11: catatonit (pod infra init), nftables (netavark firewall
  backend), docker-compose (external compose provider for `podman compose`)
  — all vendored prebuilt binaries, versions.env pinned, propagated through
  build-packages.sh/release.sh/podman.plg/verify+update-packages.sh.
- Fix WebUI: every POST action was silently failing (empty response body)
  because Unraid's own CSRF protection was never satisfied — app.js now
  sends the page's csrf_token as X-CSRF-Token.
- Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but
  /images/pull actually streams newline-delimited JSON — every successful
  pull was throwing "Expected a JSON object/array response".
- Fix WebUI: compose.php's up/down status detection had the same
  single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was
  corrupting the parse.
- Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a
  redeployed JS/CSS fix isn't served stale from browser cache.
- Add a reusable modal dialog (app.js openFormModal) replacing
  prompt()/alert() for New Volume/Network/Pull Image.
- Add host-path (bind-mount) support when creating a named volume.
- Add Create Container (image, name, network mode incl. custom networks,
  ports, volumes, env, restart policy, privileged, start-after-create),
  auto-pulling the image on first use since /containers/create doesn't.

All fixes verified live against a real podman system service and, where
reachable, via the actual WebUI over the real socket — not just unit-level.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webui/plugins/podman/javascript/volumes.js

@@ -2,8 +2,12 @@
  * javascript/volumes.js
  *
  * Volumes panel: named-volume table + create/remove, backed by
- * ajax/volumes.php. Bind mounts are deliberately not shown here — see
- * that file's header comment.
+ * ajax/volumes.php. Container-level bind mounts (e.g. appdata under
+ * /mnt/user/appdata/...) are deliberately not shown here, since they
+ * aren't a libpod-managed resource at all — see that file's header
+ * comment. A named volume created here WITH a host path (v.hostPath) IS
+ * still a real, listed podman volume, just backed by that path instead
+ * of podman's own internal storage — see PodmanClient::createVolume().
  */
 (function () {
   'use strict';
@@ -11,11 +15,14 @@
   let volumes = [];
 
   function rowHtml(v) {
+    const pathCell = v.hostPath
+      ? P.escapeHtml(v.hostPath) + ' <span class="podman-chip podman-chip-neutral" title="Bind-mounted to this host path">bind</span>'
+      : P.escapeHtml(v.mountpoint);
     return '' +
       '<tr data-name="' + P.escapeHtml(v.name) + '">' +
       '<td>' + P.escapeHtml(v.name) + '</td>' +
       '<td><span class="podman-chip podman-chip-neutral">' + P.escapeHtml(v.driver) + '</span></td>' +
-      '<td class="mono podman-row-sub">' + P.escapeHtml(v.mountpoint) + '</td>' +
+      '<td class="mono podman-row-sub">' + pathCell + '</td>' +
       '<td class="tnum">' + v.usedBy + '</td>' +
       '<td class="podman-actions"><button class="podman-btn podman-btn-icon" data-action="remove"' +
       (v.usedBy > 0 ? ' disabled title="In use by a container"' : ' title="Remove"') + '>&#128465;</button></td>' +
@@ -42,10 +49,20 @@
 
   function init() {
     P.el('volumes-create-btn').addEventListener('click', function () {
-      const name = prompt('New volume name:');
-      if (!name) return;
-      P.post('volumes', 'create', { name: name }).then(load).catch(function (err) {
-        alert('Create failed: ' + err.message);
+      P.openFormModal({
+        title: 'New Volume',
+        submitLabel: 'Create',
+        fields: [
+          { name: 'name', label: 'Volume name', required: true, placeholder: 'my-volume' },
+          {
+            name: 'path', label: 'Host path (optional)', placeholder: '/mnt/cache/appdata/my-volume',
+            hint: 'Leave empty for a podman-managed volume. Set this to bind the volume ' +
+              'directly to an existing directory on disk (e.g. a cache pool path) instead.',
+          },
+        ],
+        onSubmit: function (values) {
+          return P.post('volumes', 'create', { name: values.name, path: values.path || undefined }).then(load);
+        },
       });
     });