Phase 3: env masking, image updates, port conflicts, resources, templates (0.3.0)

Backend:
- update_service: registry manifest digest check (Docker Hub/ghcr/lscr/private
  v2 token auth) vs local RepoDigests; in-memory cache + background loop
- port_service: parse compose ports, check /proc/net/tcp[6] + docker bindings
- template_service + bundled templates (jellyfin/vaultwarden/uptime-kuma/
  paperless-ngx/gitea) with {{VAR}} placeholders; custom templates in DB
- compose_edit set_resources (deploy.resources.limits/reservations)
- routers: images, ports, templates, editor/set-resources
- Template model; background update task wired into lifespan

Frontend:
- EnvEditor (table + raw, sensitive masking, quick-insert)
- Images page + UpdateBadge + dashboard 'updates available' banner
- PortConflictDialog pre-deploy check on Deploy
- ResourcePanel (CPU/RAM sliders) as editor Limits tab
- Templates page with per-variable instantiate form

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -3,8 +3,8 @@
 A self-hosted Docker Compose manager for power users and homelab enthusiasts —
 as intuitive as Dockge, as capable as Portainer for Compose workflows.
 
-> **Status:** Phase 1 (Core) + Phase 2 (Volumes & GPU) complete. Image-update
-> checks, templates, multi-host agents and backups land in later phases.
+> **Status:** Phase 1 (Core) + Phase 2 (Volumes & GPU) + Phase 3 (Quality of
+> Life) complete. Multi-host agents, backups and notifications land in Phase 4.
 
 ## What works today (Phase 1)
 
@@ -41,6 +41,20 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
 > GPU/device detection needs host visibility. The bundled compose bind-mounts
 > `/dev:/dev:ro`; NVIDIA additionally requires the NVIDIA container runtime on the host.
 
+### Phase 3 — Quality of Life
+
+- **Env editor**: table mode with sensitive-value masking (`PASS`/`SECRET`/`KEY`/…
+  auto-detected) + raw mode, plus PUID/PGID/TZ quick-insert.
+- **Image update checker**: background task compares the local manifest digest with
+  the registry (Docker Hub / ghcr / lscr / private v2 with token auth); update
+  badges on the Images page + an "updates available" banner on the dashboard.
+- **Port conflict detector**: pre-deploy check against host-bound ports
+  (`/proc/net/tcp[6]`) and running container bindings, with a confirm dialog.
+- **Resource limits**: CPU/memory sliders in the editor → `deploy.resources.limits`.
+- **Template library**: bundled templates (Jellyfin, Vaultwarden, Uptime-Kuma,
+  Paperless-NGX, Gitea) with `{{VARIABLE}}` forms; save any stack as a custom template.
+- **Healthcheck status** surfaced per container in the stack overview.
+
 ## Architecture
 
 ```
@@ -120,6 +134,15 @@ GET    /api/host/paths?path=&show_hidden=        (sandboxed browser)
 POST   /api/editor/services | add-volume | set-gpu | add-device | remove-device | set-privileged
 ```
 
+### Phase 3 endpoints
+
+```
+GET    /api/images | /updates                    POST /api/images/check
+POST   /api/ports/conflicts                       POST /api/editor/set-resources
+GET    /api/templates | /{id}                     POST /api/templates/{id}/instantiate
+POST   /api/templates                             DELETE /api/templates/custom/{slug}
+```
+
 ## Security notes
 
 - The Docker socket is only ever touched by the backend process; it is never