Phase 3: env masking, image updates, port conflicts, resources, templates (0.3.0)

Backend:
- update_service: registry manifest digest check (Docker Hub/ghcr/lscr/private
  v2 token auth) vs local RepoDigests; in-memory cache + background loop
- port_service: parse compose ports, check /proc/net/tcp[6] + docker bindings
- template_service + bundled templates (jellyfin/vaultwarden/uptime-kuma/
  paperless-ngx/gitea) with {{VAR}} placeholders; custom templates in DB
- compose_edit set_resources (deploy.resources.limits/reservations)
- routers: images, ports, templates, editor/set-resources
- Template model; background update task wired into lifespan

Frontend:
- EnvEditor (table + raw, sensitive masking, quick-insert)
- Images page + UpdateBadge + dashboard 'updates available' banner
- PortConflictDialog pre-deploy check on Deploy
- ResourcePanel (CPU/RAM sliders) as editor Limits tab
- Templates page with per-variable instantiate form

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/templates/manifest.json

@@ -0,0 +1,74 @@
+[
+  {
+    "id": "jellyfin",
+    "name": "Jellyfin",
+    "description": "Free media streaming server with optional hardware transcoding.",
+    "tags": ["media", "streaming"],
+    "gpu": "NVIDIA / Intel optional",
+    "file": "jellyfin.yaml",
+    "variables": [
+      { "name": "PUID", "description": "User ID", "default": "1000" },
+      { "name": "PGID", "description": "Group ID", "default": "1000" },
+      { "name": "TZ", "description": "Timezone", "default": "Europe/Berlin" },
+      { "name": "CONFIG_PATH", "description": "Host path for config", "default": "/srv/jellyfin/config" },
+      { "name": "MEDIA_PATH", "description": "Host path to media library", "default": "/srv/media" },
+      { "name": "HTTP_PORT", "description": "Web UI port", "default": "8096" }
+    ]
+  },
+  {
+    "id": "vaultwarden",
+    "name": "Vaultwarden",
+    "description": "Lightweight Bitwarden-compatible password manager.",
+    "tags": ["password-manager", "security"],
+    "gpu": null,
+    "file": "vaultwarden.yaml",
+    "variables": [
+      { "name": "TZ", "description": "Timezone", "default": "Europe/Berlin" },
+      { "name": "DATA_PATH", "description": "Host path for data", "default": "/srv/vaultwarden" },
+      { "name": "HTTP_PORT", "description": "Web UI port", "default": "8200" },
+      { "name": "ADMIN_TOKEN", "description": "Admin panel token", "default": "change-me" }
+    ]
+  },
+  {
+    "id": "uptime-kuma",
+    "name": "Uptime Kuma",
+    "description": "Self-hosted uptime / status monitoring tool.",
+    "tags": ["monitoring"],
+    "gpu": null,
+    "file": "uptime-kuma.yaml",
+    "variables": [
+      { "name": "DATA_PATH", "description": "Host path for data", "default": "/srv/uptime-kuma" },
+      { "name": "HTTP_PORT", "description": "Web UI port", "default": "3001" }
+    ]
+  },
+  {
+    "id": "paperless-ngx",
+    "name": "Paperless-NGX",
+    "description": "Document management system that indexes scanned documents.",
+    "tags": ["documents"],
+    "gpu": null,
+    "file": "paperless-ngx.yaml",
+    "variables": [
+      { "name": "TZ", "description": "Timezone", "default": "Europe/Berlin" },
+      { "name": "DATA_PATH", "description": "Host path base", "default": "/srv/paperless" },
+      { "name": "HTTP_PORT", "description": "Web UI port", "default": "8000" },
+      { "name": "ADMIN_USER", "description": "Admin username", "default": "admin" },
+      { "name": "ADMIN_PASSWORD", "description": "Admin password", "default": "change-me" }
+    ]
+  },
+  {
+    "id": "gitea",
+    "name": "Gitea",
+    "description": "Lightweight self-hosted Git service.",
+    "tags": ["git", "dev"],
+    "gpu": null,
+    "file": "gitea.yaml",
+    "variables": [
+      { "name": "PUID", "description": "User ID", "default": "1000" },
+      { "name": "PGID", "description": "Group ID", "default": "1000" },
+      { "name": "DATA_PATH", "description": "Host path for data", "default": "/srv/gitea" },
+      { "name": "HTTP_PORT", "description": "Web UI port", "default": "3000" },
+      { "name": "SSH_PORT", "description": "SSH port", "default": "2222" }
+    ]
+  }
+]