Let a stuck backup be stopped instead of stranding the stack (0.67.0)

A backup holds the stack lock for up to twelve hours — a large volume
legitimately takes that long — and stops the stack's containers for a
consistent snapshot. One that died without unwinding therefore left the
stack stopped and refusing every start, stop, restart and deploy with
"Stack 'npmplus' is busy: backup in progress", with nothing to click
until the TTL ran out.

Backups and restores now register themselves in stack_job_service while
they run, with their phase and the helper containers they stream
through. Cancelling sets a flag and removes those containers, which is
what actually ends the long read: the backup then unwinds through its
own finally — the half-written archive goes, the containers it stopped
are started again, the lock is released. Checks sit between two files
and two volumes, never inside one. A restore is not cancellable at all;
it is halfway through writing a stack's data back.

POST /api/stacks/{id}/unlock does that and waits for it. A backup lock
with no job behind it is a leftover, so it is released on one click; a
deploy lock takes an explicit force, because compose keeps running past
its request. GET /api/stacks/{id}/lock and the stack detail response say
what holds the stack and since when, and the stack page turns that into
"Stop backup" / "Release lock".

Startup now clears every lock rather than only expired ones: after a
restart nothing of ours is in flight, the same reasoning the leftover
helper containers already follow.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/test_route_authorization.py

@@ -89,6 +89,10 @@ USER_READABLE = {
     # The stack's uploaded icon — an image the user already sees next to the
     # stack's name in the list. Uploading and resetting it stay admin-only.
     "GET /api/stacks/{stack_id}/icon",
+    # Which operation holds the stack and since when — the same "updating"
+    # the list already shows, with the detail behind it. Stopping it
+    # (POST .../unlock) is admin-only.
+    "GET /api/stacks/{stack_id}/lock",
     "GET /api/stacks/{stack_id}/logs",
     "GET /api/stacks/{stack_id}/services/{service}/logs",
     "POST /api/stacks/convert",