Phase 3: env masking, image updates, port conflicts, resources, templates (0.3.0)

Backend:
- update_service: registry manifest digest check (Docker Hub/ghcr/lscr/private
  v2 token auth) vs local RepoDigests; in-memory cache + background loop
- port_service: parse compose ports, check /proc/net/tcp[6] + docker bindings
- template_service + bundled templates (jellyfin/vaultwarden/uptime-kuma/
  paperless-ngx/gitea) with {{VAR}} placeholders; custom templates in DB
- compose_edit set_resources (deploy.resources.limits/reservations)
- routers: images, ports, templates, editor/set-resources
- Template model; background update task wired into lifespan

Frontend:
- EnvEditor (table + raw, sensitive masking, quick-insert)
- Images page + UpdateBadge + dashboard 'updates available' banner
- PortConflictDialog pre-deploy check on Deploy
- ResourcePanel (CPU/RAM sliders) as editor Limits tab
- Templates page with per-variable instantiate form

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/ports.py

@@ -0,0 +1,21 @@
+"""Port conflict detection endpoint."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+
+from auth import get_current_user
+from models.user import User
+from services import port_service
+
+router = APIRouter(prefix="/api/ports", tags=["ports"])
+
+
+class ConflictBody(BaseModel):
+    yaml: str
+    ignore_stack: str | None = None
+
+
+@router.post("/conflicts")
+def conflicts(body: ConflictBody, _user: User = Depends(get_current_user)) -> dict:
+    return {"conflicts": port_service.detect_conflicts(body.yaml, body.ignore_stack)}