Phase 3: env masking, image updates, port conflicts, resources, templates (0.3.0)

Backend:
- update_service: registry manifest digest check (Docker Hub/ghcr/lscr/private
  v2 token auth) vs local RepoDigests; in-memory cache + background loop
- port_service: parse compose ports, check /proc/net/tcp[6] + docker bindings
- template_service + bundled templates (jellyfin/vaultwarden/uptime-kuma/
  paperless-ngx/gitea) with {{VAR}} placeholders; custom templates in DB
- compose_edit set_resources (deploy.resources.limits/reservations)
- routers: images, ports, templates, editor/set-resources
- Template model; background update task wired into lifespan

Frontend:
- EnvEditor (table + raw, sensitive masking, quick-insert)
- Images page + UpdateBadge + dashboard 'updates available' banner
- PortConflictDialog pre-deploy check on Deploy
- ResourcePanel (CPU/RAM sliders) as editor Limits tab
- Templates page with per-variable instantiate form

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/api/images.ts

@@ -0,0 +1,27 @@
+import api from "./client";
+
+export interface UpdateStatus {
+  image: string;
+  update_available: boolean;
+  current_digest: string | null;
+  remote_digest: string | null;
+  checked_at: number;
+  error: string | null;
+}
+
+export interface ImageRow {
+  id: string;
+  tag: string;
+  size: number;
+  created: string;
+  stacks: string[];
+  update: UpdateStatus | null;
+}
+
+export const imagesApi = {
+  list: () => api.get<ImageRow[]>("/api/images").then((r) => r.data),
+  updates: () =>
+    api.get<Record<string, UpdateStatus>>("/api/images/updates").then((r) => r.data),
+  check: () =>
+    api.post<Record<string, UpdateStatus>>("/api/images/check").then((r) => r.data),
+};