Phase 4: backups w/ volumes, notifications, settings & users, audit page (0.4.0)

- Backup/restore: per-stack tar.gz incl. named-volume snapshots (helper
  container), upload restore with rename/overwrite/conflict detection.
- Notifications: ntfy/Discord/Slack/Gotify/generic webhooks, per-event
  subscriptions; wired into the update checker and stack lifecycle.
- Settings page: update-check interval, webhook CRUD + test, user management
  (with last-admin safeguards).
- Audit log page (searchable, paginated).
- Mobile-responsive sidebar/layout.

Multi-host agents and remote backup destinations (SFTP/S3) deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/config.py

@@ -32,6 +32,9 @@ class Settings(BaseSettings):
     DOCKER_SOCKET: str = "/var/run/docker.sock"
     HOST_PROC_PATH: str = "/host_proc"
 
+    # Throwaway image used to read/write named-volume contents during backup.
+    BACKUP_HELPER_IMAGE: str = "alpine:latest"
+
     # Host browser sandbox roots
     ALLOWED_BROWSE_ROOTS: Annotated[list[str], NoDecode] = [
         "/", "/mnt", "/media", "/srv", "/opt",