Phase 3: env masking, image updates, port conflicts, resources, templates (0.3.0)

Backend:
- update_service: registry manifest digest check (Docker Hub/ghcr/lscr/private
  v2 token auth) vs local RepoDigests; in-memory cache + background loop
- port_service: parse compose ports, check /proc/net/tcp[6] + docker bindings
- template_service + bundled templates (jellyfin/vaultwarden/uptime-kuma/
  paperless-ngx/gitea) with {{VAR}} placeholders; custom templates in DB
- compose_edit set_resources (deploy.resources.limits/reservations)
- routers: images, ports, templates, editor/set-resources
- Template model; background update task wired into lifespan

Frontend:
- EnvEditor (table + raw, sensitive masking, quick-insert)
- Images page + UpdateBadge + dashboard 'updates available' banner
- PortConflictDialog pre-deploy check on Deploy
- ResourcePanel (CPU/RAM sliders) as editor Limits tab
- Templates page with per-variable instantiate form

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/main.py

@@ -1,6 +1,7 @@
 """StackPilot backend — FastAPI application entry point."""
 from __future__ import annotations
 
+import asyncio
 import logging
 from contextlib import asynccontextmanager
 
@@ -12,7 +13,19 @@ from sqlmodel import Session
 from config import settings
 from database import engine, init_db
 from docker_client import DockerError
-from routers import audit, auth, editor, stacks, system, volumes, ws
+from routers import (
+    audit,
+    auth,
+    editor,
+    images,
+    ports,
+    stacks,
+    system,
+    templates,
+    volumes,
+    ws,
+)
+from services import update_service
 
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger("stackpilot")
@@ -27,11 +40,13 @@ async def lifespan(app: FastAPI):
             stacks.sync_discovered_stacks(session)
     except Exception as exc:  # noqa: BLE001
         logger.warning("Stack discovery failed: %s", exc)
+    update_task = asyncio.create_task(update_service.background_loop())
     logger.info("StackPilot backend ready on port %s", settings.PORT)
     yield
+    update_task.cancel()
 
 
-app = FastAPI(title="StackPilot", version="0.2.0", lifespan=lifespan)
+app = FastAPI(title="StackPilot", version="0.3.0", lifespan=lifespan)
 
 app.add_middleware(
     CORSMiddleware,
@@ -55,6 +70,9 @@ app.include_router(stacks.router)
 app.include_router(system.router)
 app.include_router(volumes.router)
 app.include_router(editor.router)
+app.include_router(images.router)
+app.include_router(ports.router)
+app.include_router(templates.router)
 app.include_router(audit.router)
 app.include_router(ws.router)