Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt,
  and fuse-overlayfs to verified upstream source checksums; SlackBuild
  recipes, scripts/build-packages.sh, checksums.sh, release.sh, and
  update-versions.sh implement the reproducible pipeline; GitHub Actions
  workflows build in a Slackware container and publish releases without
  committing any binaries.

- plugin/podman.plg installs/updates/removes all eight packages (the
  seven components plus the plugin's own unraid-podman scaffolding
  package) via upgradepkg, using the official Unraid array-event hook
  mechanism (event/disks_mounted, event/stopping) instead of editing
  /boot/config/go. rc.podman and the sbin/ helper scripts implement
  storage creation, config seeding/sync, preflight checks, autostart
  with per-container Safe-Mode, and package verify/update/rollback.

- webui/plugins/podman implements the Dashboard, Containers, Pods,
  Images, Volumes, Networks, Logs, Terminal, Compose, and Settings
  panels against the approved mockup (webui/mockups/prototype.html),
  talking to podman system service exclusively via PodmanClient.php
  (libpod REST API over the Unix socket), with two documented
  exceptions: Terminal's one-shot exec model and Compose's use of the
  podman compose CLI, since libpod has no REST equivalent for either.

- docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions
  and honest current status (syntax-checked, unit- and
  integration-tested against fake sockets/servers; not yet run against
  a real Unraid/Podman/Slackware system).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webui/plugins/podman/include/helpers.php

@@ -0,0 +1,107 @@
+<?php
+/**
+ * helpers.php
+ *
+ * Small, stateless formatting helpers shared by the ajax/*.php endpoints.
+ * Kept separate from PodmanClient (which only knows the API) and from the
+ * endpoints themselves (which only know their one resource), so the same
+ * "format 1610612736 bytes as 1.5 GB" logic isn't duplicated across
+ * images.php, volumes.php, and system.php.
+ */
+
+declare(strict_types=1);
+
+function podman_format_bytes(int $bytes): string
+{
+    if ($bytes <= 0) {
+        return '0 B';
+    }
+    $units = ['B', 'KB', 'MB', 'GB', 'TB'];
+    $i = (int) floor(log($bytes, 1024));
+    $i = min($i, count($units) - 1);
+    $value = $bytes / (1024 ** $i);
+    return sprintf($value >= 100 || $i === 0 ? '%.0f %s' : '%.1f %s', $value, $units[$i]);
+}
+
+/** Formats a duration in seconds as a compact "14d 6h" / "6h 12m" / "38m" style string. */
+function podman_format_duration(int $seconds): string
+{
+    if ($seconds < 60) {
+        return $seconds . 's';
+    }
+    $days = intdiv($seconds, 86400);
+    $hours = intdiv($seconds % 86400, 3600);
+    $minutes = intdiv($seconds % 3600, 60);
+
+    if ($days > 0) {
+        return "{$days}d {$hours}h";
+    }
+    if ($hours > 0) {
+        return "{$hours}h {$minutes}m";
+    }
+    return "{$minutes}m";
+}
+
+/** Converts a libpod RFC3339 timestamp (as found in inspect output) to a Unix timestamp, or null if unparsable. */
+function podman_parse_time(?string $rfc3339): ?int
+{
+    if ($rfc3339 === null || $rfc3339 === '' || str_starts_with($rfc3339, '0001-01-01')) {
+        return null;
+    }
+    $ts = strtotime($rfc3339);
+    return $ts === false ? null : $ts;
+}
+
+/**
+ * Shortens a full image/container ID to the 12-character form Docker/
+ * Podman CLIs conventionally display, matching what users expect to see
+ * (and copy-paste into `podman inspect <id>`, which accepts short IDs).
+ */
+function podman_short_id(string $id): string
+{
+    // Some APIs prefix with "sha256:" for image IDs.
+    $id = str_starts_with($id, 'sha256:') ? substr($id, 7) : $id;
+    return substr($id, 0, 12);
+}
+
+/**
+ * Sends a JSON response and terminates the request — every ajax/*.php
+ * endpoint's single exit point, so response shape (envelope with "ok" and
+ * either "data" or "error") is consistent for the frontend's shared AJAX
+ * helper (javascript/app.js's request() function) to rely on.
+ */
+function podman_json_response(mixed $data, int $httpStatus = 200): never
+{
+    http_response_code($httpStatus);
+    header('Content-Type: application/json');
+    echo json_encode(['ok' => $httpStatus < 400, 'data' => $data], JSON_UNESCAPED_SLASHES);
+    exit;
+}
+
+function podman_json_error(string $message, int $httpStatus = 500): never
+{
+    http_response_code($httpStatus);
+    header('Content-Type: application/json');
+    echo json_encode(['ok' => false, 'error' => $message], JSON_UNESCAPED_SLASHES);
+    exit;
+}
+
+/**
+ * Reads and JSON-decodes the request body for POST/DELETE actions that
+ * take parameters (e.g. {"id": "..."}), with a friendly error on
+ * malformed input instead of a fatal error deep inside an endpoint.
+ *
+ * @return array<string,mixed>
+ */
+function podman_read_json_body(): array
+{
+    $raw = file_get_contents('php://input');
+    if ($raw === false || trim($raw) === '') {
+        return [];
+    }
+    $decoded = json_decode($raw, true);
+    if (!is_array($decoded)) {
+        podman_json_error('Request body must be a JSON object', 400);
+    }
+    return $decoded;
+}