Phase 9: network management + stack delete in UI (0.9.0)

- Networks: network_service (list w/ subnet/containers/in-use/owning-stack,
  create bridge/macvlan/ipvlan/overlay + optional subnet/gateway/internal,
  delete with default-network guard, prune) + routers/networks.py; real
  Networks page replaces the placeholder.
- Fix: local stacks can now be deleted from the UI — Delete button on stack
  detail (with optional keep-files-on-disk) and a trash action on stack cards,
  via a shared ConfirmDialog. (Backend DELETE existed; no UI surfaced it.)

Verified: py_compile, frontend tsc build, live network list smoke test
(defaults flagged, compose nets + in-use detected); main 104 routes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -6,7 +6,7 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
 > **Status:** Phase 1 (Core) + Phase 2 (Volumes & GPU) + Phase 3 (Quality of
 > Life) + Phase 4 (Operations) + Phase 5 (Multi-host) + Phase 6 (Backup
 > destinations) + Phase 7 (Scheduled backups) + Phase 8 (Remote-stack backups)
-> complete.
+> + Phase 9 (Networks) complete.
 
 ## What works today (Phase 1)
 
@@ -112,6 +112,16 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
   are namespaced per host (`backup-<host>-<stack>-…`) so retention never prunes
   across hosts sharing a destination.
 
+### Phase 9 — Networks
+
+- **Network management**: the Networks page lists Docker networks (driver, scope,
+  subnet, attached containers / in-use, owning stack), with **create** (bridge /
+  macvlan / ipvlan / overlay, optional subnet+gateway, internal/attachable),
+  **delete** (default networks protected; in-use guarded by Docker), and **prune
+  unused**.
+- **Stack delete**: local stacks can now be deleted from the UI (stack detail and
+  the stack card), with a confirm dialog and an optional "keep files on disk".
+
 ## Deploying an agent on another host
 
 ```bash
@@ -265,6 +275,14 @@ POST   /api/agents/{id}/stacks/restore             POST /api/agents/{id}/stacks/
 backup schedules accept an optional agent_id to target a remote host.
 ```
 
+### Phase 9 endpoints
+
+```
+GET    /api/networks | /{id}                       POST /api/networks
+DELETE /api/networks/{id}                           POST /api/networks/prune
+DELETE /api/stacks/{id}?delete_files=             (stack delete, now surfaced in the UI)
+```
+
 ## Security notes
 
 - The Docker socket is only ever touched by the backend process; it is never