Phase 4: backups w/ volumes, notifications, settings & users, audit page (0.4.0)

- Backup/restore: per-stack tar.gz incl. named-volume snapshots (helper
  container), upload restore with rename/overwrite/conflict detection.
- Notifications: ntfy/Discord/Slack/Gotify/generic webhooks, per-event
  subscriptions; wired into the update checker and stack lifecycle.
- Settings page: update-check interval, webhook CRUD + test, user management
  (with last-admin safeguards).
- Audit log page (searchable, paginated).
- Mobile-responsive sidebar/layout.

Multi-host agents and remote backup destinations (SFTP/S3) deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -9,6 +9,11 @@ services:
       - DATA_DIR=/data
       - HOST_PROC_PATH=/host_proc
       - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5009}
+      # Optional: comma-separated generic JSON webhook URLs (every event).
+      # Per-destination webhooks (ntfy/Discord/Slack/Gotify) are managed in the UI.
+      - NOTIFY_WEBHOOKS=${NOTIFY_WEBHOOKS:-}
+      # Throwaway image used to snapshot named-volume contents during backups.
+      - BACKUP_HELPER_IMAGE=${BACKUP_HELPER_IMAGE:-alpine:latest}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data:/data