Phase 3: env masking, image updates, port conflicts, resources, templates (0.3.0)

Backend:
- update_service: registry manifest digest check (Docker Hub/ghcr/lscr/private
  v2 token auth) vs local RepoDigests; in-memory cache + background loop
- port_service: parse compose ports, check /proc/net/tcp[6] + docker bindings
- template_service + bundled templates (jellyfin/vaultwarden/uptime-kuma/
  paperless-ngx/gitea) with {{VAR}} placeholders; custom templates in DB
- compose_edit set_resources (deploy.resources.limits/reservations)
- routers: images, ports, templates, editor/set-resources
- Template model; background update task wired into lifespan

Frontend:
- EnvEditor (table + raw, sensitive masking, quick-insert)
- Images page + UpdateBadge + dashboard 'updates available' banner
- PortConflictDialog pre-deploy check on Deploy
- ResourcePanel (CPU/RAM sliders) as editor Limits tab
- Templates page with per-variable instantiate form

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/editor.py

@@ -36,6 +36,15 @@ class PrivilegedBody(BaseModel):
     value: bool
 
 
+class ResourcesBody(BaseModel):
+    yaml: str
+    service: str
+    cpus: float | None = None
+    memory: str | None = None
+    cpus_reserve: float | None = None
+    memory_reserve: str | None = None
+
+
 def _run(fn, *args) -> dict:
     try:
         return {"yaml": fn(*args)}
@@ -74,3 +83,20 @@ def remove_device(body: DeviceBody, _user: User = Depends(get_current_user)) ->
 @router.post("/set-privileged")
 def set_privileged(body: PrivilegedBody, _user: User = Depends(get_current_user)) -> dict:
     return _run(edit.set_privileged, body.yaml, body.service, body.value)
+
+
+@router.post("/set-resources")
+def set_resources(body: ResourcesBody, _user: User = Depends(get_current_user)) -> dict:
+    try:
+        return {
+            "yaml": edit.set_resources(
+                body.yaml,
+                body.service,
+                cpus=body.cpus,
+                memory=body.memory,
+                cpus_reserve=body.cpus_reserve,
+                memory_reserve=body.memory_reserve,
+            )
+        }
+    except edit.EditError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc