Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt,
  and fuse-overlayfs to verified upstream source checksums; SlackBuild
  recipes, scripts/build-packages.sh, checksums.sh, release.sh, and
  update-versions.sh implement the reproducible pipeline; GitHub Actions
  workflows build in a Slackware container and publish releases without
  committing any binaries.

- plugin/podman.plg installs/updates/removes all eight packages (the
  seven components plus the plugin's own unraid-podman scaffolding
  package) via upgradepkg, using the official Unraid array-event hook
  mechanism (event/disks_mounted, event/stopping) instead of editing
  /boot/config/go. rc.podman and the sbin/ helper scripts implement
  storage creation, config seeding/sync, preflight checks, autostart
  with per-container Safe-Mode, and package verify/update/rollback.

- webui/plugins/podman implements the Dashboard, Containers, Pods,
  Images, Volumes, Networks, Logs, Terminal, Compose, and Settings
  panels against the approved mockup (webui/mockups/prototype.html),
  talking to podman system service exclusively via PodmanClient.php
  (libpod REST API over the Unix socket), with two documented
  exceptions: Terminal's one-shot exec model and Compose's use of the
  podman compose CLI, since libpod has no REST equivalent for either.

- docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions
  and honest current status (syntax-checked, unit- and
  integration-tested against fake sockets/servers; not yet run against
  a real Unraid/Podman/Slackware system).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/passt/README.md

@@ -0,0 +1,21 @@
+# packages/passt
+
+Slackware package build recipe for **passt** (and its `pasta` counterpart).
+
+- Upstream: https://passt.top/passt/about/ (cgit, no GitHub mirror)
+- Pinned commit: see `PASST_COMMIT` in [versions.env](../../versions.env)
+- Patches: see `patches/` (currently none)
+- Build entry point: `passt.SlackBuild`
+
+## Notes
+
+Unlike the other six packages, passt has no tagged releases or semver
+versioning upstream — distributions package it straight from a pinned git
+commit (this is also how Fedora/Debian build it). `scripts/update-versions.sh`
+handles re-pinning to a newer commit and recomputing the snapshot checksum;
+see [versions.env](../../versions.env) for the exact snapshot URL pattern.
+
+Not required for the Phase 1 (rootful) MVP — passt/pasta become relevant once
+rootless Podman support is added (see
+[docs/ROADMAP.md](../../docs/ROADMAP.md), Phase 3). It is built now so the
+package pipeline covers the full dependency set from day one.

packages/passt/passt.SlackBuild

@@ -0,0 +1,49 @@
+#!/bin/bash
+# =============================================================================
+# packages/passt/passt.SlackBuild
+#
+# Builds the passt/pasta .txz package from upstream source (C, plain
+# Makefile — no autotools). passt is Podman's modern unprivileged
+# user-mode network transport for rootless containers, superseding
+# slirp4netns (see versions.env for why this project pins it via a git
+# commit snapshot rather than a tagged release: upstream has no GitHub
+# mirror and does not use semver tags).
+#
+# Requires (in the build environment): gcc, make. No external library
+# dependencies beyond libc — passt deliberately avoids them.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$PASST_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "passt"
+
+tarball=$(sb_fetch_and_verify "$PASST_SRC_URL" "$PASST_SRC_SHA256" "passt-$PASST_COMMIT.tar.gz")
+srcdir=$(sb_extract "$tarball")
+
+for patch in "$CWD"/patches/*.patch; do
+  [ -e "$patch" ] || continue
+  echo "==> [passt] applying $(basename "$patch")"
+  patch -d "$srcdir" -p1 < "$patch"
+done
+
+cd "$srcdir"
+
+echo "==> [passt] make"
+make
+
+echo "==> [passt] make install into \$PKG"
+make install prefix=/usr DESTDIR="$PKG"
+
+sb_install_docs "$srcdir/LICENSES/GPL-2.0-or-later.txt" "$srcdir/README.md"
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"

packages/passt/slack-desc

@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+passt: passt (unprivileged user-mode networking for VMs/containers)
+passt:
+passt: passt and pasta provide unprivileged (rootless) user-mode network
+passt: connectivity for containers and VMs, without requiring a tap device
+passt: or elevated capabilities. Podman uses it as the rootless network
+passt: transport, superseding slirp4netns.
+passt:
+passt: Homepage: https://passt.top/passt/about/
+passt:
+passt:
+passt: