Add GPU/macvlan passthrough, container edit/update, image prune/tag

Create Container form:
- GPU passthrough dropdown (AMD/Intel via /dev/dri detection, NVIDIA
  excluded since it needs a different runtime) - device paths strictly
  validated server-side against the host's own detected list.
- Macvlan network support: selecting a macvlan network reveals a static
  IP field and hides port mappings (meaningless once the container has
  its own LAN address), matching Unraid Docker Manager's "Custom: br0"
  behavior. Networks panel gained a matching macvlan network-creation
  flow, with the parent-interface dropdown read from Unraid's own
  network.cfg so it lists exactly what Docker Manager itself offers.

Containers panel:
- Edit: reopens the create form pre-filled from the container's current
  config (image/ports/volumes/env/network/restart policy/GPU/static IP);
  saving stops+removes the old container and recreates it under the same
  settings, since podman/Docker have no in-place "modify" API for most of
  this.
- Update: same stop/remove/recreate flow, but pulls the current image
  first. "Check for Updates" compares each in-use image's local digest
  against its origin registry (Docker Hub/GHCR/self-hosted registries all
  verified live) with no podman-side feature backing it - implemented via
  the registry's own HTTP API. A small log-modal shows progress for both
  actions instead of a silent wait.
- Fixed a real bug hit live: PodmanClient's flat 15s HTTP timeout aborted
  real image pulls/container creates mid-request; bumped to 600s (nginx
  already allows up to 640s for this plugin's requests).

Images panel:
- "Prune unused" (removes every image with zero containers referencing
  it, not just dangling ones - confirmation copy says so explicitly since
  this is more aggressive than it sounds) and per-image "Tag".

Also several real UI bugs found via live screenshots: unused-image prune
having no visible effect until reloaded, table action-button columns
drifting row to row (a bare "display:flex" on a <td> was fighting the
table layout algorithm), Templates category badges dumping raw multi-tag
strings from real Unraid templates, and low-contrast search/filter
controls that were nearly invisible against the card background.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webui/plugins/podman/ajax/images.php

@@ -8,6 +8,8 @@
  *   list     GET  -> normalized image list
  *   pull     POST {"reference": "docker.io/library/postgres:16"}
  *   remove   POST {"id": "...", "force": false}
+ *   prune    POST {} -> removes every image not used by any container
+ *   tag      POST {"id": "...", "repo": "...", "tag": "latest"}
  */
 
 declare(strict_types=1);
@@ -40,6 +42,27 @@ switch ($action) {
         podman_json_response(['status' => 'removed']);
         break;
 
+    case 'prune':
+        $removed = $client->pruneImages();
+        $reclaimed = 0;
+        foreach ($removed as $r) {
+            $reclaimed += (int) ($r['Size'] ?? 0);
+        }
+        podman_json_response(['removedCount' => count($removed), 'reclaimedBytes' => $reclaimed]);
+        break;
+
+    case 'tag':
+        $body = podman_read_json_body();
+        $id = (string) ($body['id'] ?? '');
+        $repo = trim((string) ($body['repo'] ?? ''));
+        $tag = trim((string) ($body['tag'] ?? '')) ?: 'latest';
+        if ($id === '' || $repo === '') {
+            podman_json_error('Missing id or repo in request body', 400);
+        }
+        $client->tagImage($id, $repo, $tag);
+        podman_json_response(['status' => 'tagged']);
+        break;
+
     default:
         podman_json_error("Unknown action '{$action}'", 400);
 }