Phase 3: env masking, image updates, port conflicts, resources, templates (0.3.0)

Backend:
- update_service: registry manifest digest check (Docker Hub/ghcr/lscr/private
  v2 token auth) vs local RepoDigests; in-memory cache + background loop
- port_service: parse compose ports, check /proc/net/tcp[6] + docker bindings
- template_service + bundled templates (jellyfin/vaultwarden/uptime-kuma/
  paperless-ngx/gitea) with {{VAR}} placeholders; custom templates in DB
- compose_edit set_resources (deploy.resources.limits/reservations)
- routers: images, ports, templates, editor/set-resources
- Template model; background update task wired into lifespan

Frontend:
- EnvEditor (table + raw, sensitive masking, quick-insert)
- Images page + UpdateBadge + dashboard 'updates available' banner
- PortConflictDialog pre-deploy check on Deploy
- ResourcePanel (CPU/RAM sliders) as editor Limits tab
- Templates page with per-variable instantiate form

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/models/template.py

@@ -0,0 +1,57 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Optional
+
+from sqlmodel import Field, SQLModel
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+class Template(SQLModel, table=True):
+    """User-saved custom template (bundled ones live on disk)."""
+
+    id: Optional[int] = Field(default=None, primary_key=True)
+    slug: str = Field(index=True, unique=True)
+    name: str
+    description: Optional[str] = None
+    tags: str = ""  # comma separated
+    yaml: str = ""
+    created_at: datetime = Field(default_factory=_now)
+
+
+# --- API schemas ---
+
+
+class TemplateVariable(SQLModel):
+    name: str
+    description: str = ""
+    default: str = ""
+
+
+class TemplateSummary(SQLModel):
+    id: str
+    name: str
+    description: Optional[str] = None
+    tags: list[str] = []
+    gpu: Optional[str] = None
+    source: str = "bundled"  # "bundled" | "custom"
+
+
+class TemplateDetail(TemplateSummary):
+    yaml: str
+    variables: list[TemplateVariable] = []
+
+
+class TemplateSaveRequest(SQLModel):
+    name: str
+    description: Optional[str] = None
+    tags: list[str] = []
+    yaml: str
+
+
+class TemplateInstantiateRequest(SQLModel):
+    name: str  # new stack name
+    values: dict[str, str] = {}