Phase 13: multi-host networks & images (0.14.0)

Networks and Images are now per-host, rendered as a section for the local host
plus one per registered agent (like the Stacks page).

- agent_app.py: new /agent/networks (list/inspect/containers/connect/disconnect/
  create/delete/prune) and /agent/images (list/updates/check), reusing
  network_service and a new image_service; DockerError mapped to HTTP status
  (forbidden -> 400 so the proxy doesn't treat it as a token failure).
- routers/agents.py: proxy routes at /api/agents/{id}/networks/* and
  /api/agents/{id}/images/*, audit-logging mutations.
- services/image_service.py: extracted the image-listing logic so the central
  router and the agent share it.
- Frontend: networksApi/imagesApi take an optional agentId; Networks/Images
  pages render NetworksSection/ImagesSection per host with a shared HostHeader.
  Remote "Prune unused" networks resolves the address-pool-exhaustion deploy
  error from the UI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -7,7 +7,8 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
 > Life) + Phase 4 (Operations) + Phase 5 (Multi-host) + Phase 6 (Backup
 > destinations) + Phase 7 (Scheduled backups) + Phase 8 (Remote-stack backups)
 > + Phase 9 (Networks) + Phase 10 (iGPU passthrough) + Phase 11 (Remote UX &
-> network attach) + Phase 12 (File browser) complete.
+> network attach) + Phase 12 (File browser) + Phase 13 (Multi-host networks &
+> images) complete.
 
 ## What works today (Phase 1)
 
@@ -145,6 +146,20 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
   container or connect any container on the host (`POST /api/networks/{id}/connect`
   / `/disconnect`).
 
+### Phase 13 — Multi-host networks & images
+
+- **Networks and Images are now per-host.** Both pages render a section for the
+  local host plus one for every registered agent (online dot included), exactly
+  like the Stacks page. Each agent section talks to that host's Docker daemon.
+- **Remote network management**: list, inspect, create, delete, prune, and
+  connect/disconnect containers on an agent host — including a *Prune unused*
+  button, which resolves the common "all predefined address pools have been
+  fully subnetted" deploy error without SSH.
+- **Remote images**: list image tags (with using-stacks) and run on-demand update
+  checks per host.
+- New agent endpoints `/agent/networks/*` and `/agent/images/*`, proxied through
+  the central app at `/api/agents/{id}/networks/*` and `/api/agents/{id}/images/*`.
+
 ### Phase 12 — File browser
 
 - **Files page (sidebar)**: a full host filesystem browser with breadcrumb