Phase 4: backups w/ volumes, notifications, settings & users, audit page (0.4.0)

- Backup/restore: per-stack tar.gz incl. named-volume snapshots (helper
  container), upload restore with rename/overwrite/conflict detection.
- Notifications: ntfy/Discord/Slack/Gotify/generic webhooks, per-event
  subscriptions; wired into the update checker and stack lifecycle.
- Settings page: update-check interval, webhook CRUD + test, user management
  (with last-admin safeguards).
- Audit log page (searchable, paginated).
- Mobile-responsive sidebar/layout.

Multi-host agents and remote backup destinations (SFTP/S3) deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -9,3 +9,11 @@ STACKS_HOST_DIR=./data/stacks
 # Allowed CORS origin(s) for the API (comma separated). The bundled frontend
 # proxies /api, so this only matters if you call the API from another origin.
 CORS_ORIGINS=http://localhost:5009
+
+# Optional: comma-separated generic JSON webhook URLs that receive every event.
+# Richer per-destination webhooks (ntfy/Discord/Slack/Gotify, per-event) are
+# managed from Settings → Notifications in the UI.
+NOTIFY_WEBHOOKS=
+
+# Throwaway image used to read/write named-volume contents during backups.
+BACKUP_HELPER_IMAGE=alpine:latest