Phase 20: per-container inspect + start/stop/restart, local + agent (0.26.0)

Stack Overview now renders each service as an expandable ContainerCard with a
curated single-container inspect view and admin start/stop/restart buttons,
both for local stacks (GET/POST /api/containers/{id}[/{action}]) and remote
stacks (proxied via /api/agents/{id}/containers/* to the agent's new
/agent/containers/* endpoints). Only compose-managed containers are exposed.

Also bumps version 0.23.0 -> 0.26.0 (the bumps for the already-committed
Phase 18 image-prune / Phase 19 compose-validate were missed) and backfills
README sections for Phase 18/19/20.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/agents.py

@@ -947,3 +947,39 @@ async def agent_files_upload(
         target=f"{agent.name}:{path}", detail=rel_path or file.filename, ip=_ip(request),
     )
     return result
+
+
+# --------------------------------------------------------------------------- #
+# Containers (proxied)
+# --------------------------------------------------------------------------- #
+
+
+@router.get("/{agent_id}/containers/{container_id}")
+async def agent_container_inspect(
+    agent_id: int,
+    container_id: str,
+    session: Session = Depends(get_session),
+    _user: User = Depends(get_current_user),
+) -> dict:
+    agent = _get_or_404(session, agent_id)
+    return await _proxy(session, agent, "GET", f"/agent/containers/{container_id}")
+
+
+@router.post("/{agent_id}/containers/{container_id}/{action}")
+async def agent_container_action(
+    agent_id: int,
+    container_id: str,
+    action: str,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    agent = _get_or_404(session, agent_id)
+    result = await _proxy(
+        session, agent, "POST", f"/agent/containers/{container_id}/{action}"
+    )
+    audit_service.record(
+        session, user=user.username, action=f"agent.container.{action}",
+        target=f"{agent.name}/{container_id[:12]}", ip=_ip(request),
+    )
+    return result

backend/routers/containers.py

@@ -0,0 +1,37 @@
+"""Single-container inspect + lifecycle for compose-managed containers."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Request
+from sqlmodel import Session
+
+from auth import get_current_user, require_admin
+from database import get_session
+from models.user import User
+from services import audit_service, container_service
+
+router = APIRouter(prefix="/api/containers", tags=["containers"])
+
+
+def _ip(request: Request) -> str:
+    return request.client.host if request.client else "unknown"
+
+
+@router.get("/{container_id}")
+def inspect(container_id: str, _user: User = Depends(get_current_user)) -> dict:
+    return container_service.inspect_container(container_id)
+
+
+@router.post("/{container_id}/{action}")
+def action(
+    container_id: str,
+    action: str,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    result = container_service.container_action(container_id, action)
+    audit_service.record(
+        session, user=user.username, action=f"container.{action}",
+        target=container_id[:12], ip=_ip(request),
+    )
+    return result