Phase 20: per-container inspect + start/stop/restart, local + agent (0.26.0)

Stack Overview now renders each service as an expandable ContainerCard with a
curated single-container inspect view and admin start/stop/restart buttons,
both for local stacks (GET/POST /api/containers/{id}[/{action}]) and remote
stacks (proxied via /api/agents/{id}/containers/* to the agent's new
/agent/containers/* endpoints). Only compose-managed containers are exposed.

Also bumps version 0.23.0 -> 0.26.0 (the bumps for the already-committed
Phase 18 image-prune / Phase 19 compose-validate were missed) and backfills
README sections for Phase 18/19/20.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/agents.py

@@ -947,3 +947,39 @@ async def agent_files_upload(
         target=f"{agent.name}:{path}", detail=rel_path or file.filename, ip=_ip(request),
     )
     return result
+
+
+# --------------------------------------------------------------------------- #
+# Containers (proxied)
+# --------------------------------------------------------------------------- #
+
+
+@router.get("/{agent_id}/containers/{container_id}")
+async def agent_container_inspect(
+    agent_id: int,
+    container_id: str,
+    session: Session = Depends(get_session),
+    _user: User = Depends(get_current_user),
+) -> dict:
+    agent = _get_or_404(session, agent_id)
+    return await _proxy(session, agent, "GET", f"/agent/containers/{container_id}")
+
+
+@router.post("/{agent_id}/containers/{container_id}/{action}")
+async def agent_container_action(
+    agent_id: int,
+    container_id: str,
+    action: str,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    agent = _get_or_404(session, agent_id)
+    result = await _proxy(
+        session, agent, "POST", f"/agent/containers/{container_id}/{action}"
+    )
+    audit_service.record(
+        session, user=user.username, action=f"agent.container.{action}",
+        target=f"{agent.name}/{container_id[:12]}", ip=_ip(request),
+    )
+    return result