Phase 13: multi-host networks & images (0.14.0)

Networks and Images are now per-host, rendered as a section for the local host
plus one per registered agent (like the Stacks page).

- agent_app.py: new /agent/networks (list/inspect/containers/connect/disconnect/
  create/delete/prune) and /agent/images (list/updates/check), reusing
  network_service and a new image_service; DockerError mapped to HTTP status
  (forbidden -> 400 so the proxy doesn't treat it as a token failure).
- routers/agents.py: proxy routes at /api/agents/{id}/networks/* and
  /api/agents/{id}/images/*, audit-logging mutations.
- services/image_service.py: extracted the image-listing logic so the central
  router and the agent share it.
- Frontend: networksApi/imagesApi take an optional agentId; Networks/Images
  pages render NetworksSection/ImagesSection per host with a shared HostHeader.
  Remote "Prune unused" networks resolves the address-pool-exhaustion deploy
  error from the UI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/images.py

@@ -4,54 +4,15 @@ from __future__ import annotations
 from fastapi import APIRouter, Depends
 
 from auth import get_current_user, require_admin
-from docker_client import DockerError, get_client, safe_call
 from models.user import User
-from services import update_service
+from services import image_service, update_service
 
 router = APIRouter(prefix="/api/images", tags=["images"])
 
-COMPOSE_PROJECT_LABEL = "com.docker.compose.project"
-
 
 @router.get("")
 def list_images(_user: User = Depends(get_current_user)) -> list[dict]:
-    try:
-        client = get_client()
-        images = safe_call(client.images.list)
-        containers = safe_call(client.containers.list, all=True)
-    except DockerError:
-        return []
-
-    # Map image ref -> stacks using it.
-    usage: dict[str, set[str]] = {}
-    for c in containers:
-        ref = c.attrs.get("Config", {}).get("Image")
-        stack = c.labels.get(COMPOSE_PROJECT_LABEL)
-        if ref:
-            usage.setdefault(ref, set())
-            if stack:
-                usage[ref].add(stack)
-
-    cache = update_service.get_cache()
-    result = []
-    for img in images:
-        tags = img.tags or []
-        if not tags:
-            continue
-        for tag in tags:
-            upd = cache.get(tag)
-            result.append(
-                {
-                    "id": img.short_id,
-                    "tag": tag,
-                    "size": img.attrs.get("Size", 0),
-                    "created": img.attrs.get("Created"),
-                    "stacks": sorted(usage.get(tag, set())),
-                    "update": upd,
-                }
-            )
-    result.sort(key=lambda r: r["tag"])
-    return result
+    return image_service.list_images()
 
 
 @router.get("/updates")