Phase 2: Volume Wizard, GPU & device passthrough (0.2.0)

Backend:
- gpu_service: detect NVIDIA (nvidia-smi) + AMD/Intel (/dev/dri, sysfs);
  inject helpers (nvidia deploy.reservations, /dev/dri + groups + LIBVA)
- volume_service: list/orphaned/prune volumes; NFS/SMB/named/bind/tmpfs
  YAML generation (generate-yaml)
- device_service: USB/TTY/DRI detection + sandboxed host path browser
- compose_edit_service: server-side merge of volume/gpu/device fragments
- routers: volumes (+host paths), editor (services/add-volume/set-gpu/
  add-device/remove-device/set-privileged), system gpus+devices
- compose: bind-mount /dev:ro for detection

Frontend:
- split-pane StackEditor with helper panel (service picker + tabs)
- VolumeWizard (bind/named/nfs/smb/tmpfs) + HostPathBrowser
- GPUSelector, DevicePanel; api clients for volumes/editor/system

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/volumes.py

@@ -0,0 +1,97 @@
+"""Volume management, NFS/SMB YAML generation, and host path browser."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from sqlmodel import Session
+
+from auth import get_current_user, require_admin
+from database import get_session
+from models.user import User
+from services import audit_service, device_service, volume_service
+
+router = APIRouter(tags=["volumes"])
+
+
+def _ip(request: Request) -> str:
+    return request.client.host if request.client else "unknown"
+
+
+# --------------------------------------------------------------------------- #
+# Volumes
+# --------------------------------------------------------------------------- #
+
+
+@router.get("/api/volumes")
+def list_volumes(_user: User = Depends(get_current_user)) -> list[dict]:
+    return volume_service.list_volumes()
+
+
+@router.get("/api/volumes/orphaned")
+def orphaned(_user: User = Depends(get_current_user)) -> list[dict]:
+    return volume_service.orphaned_volumes()
+
+
+@router.delete("/api/volumes/{name}")
+def delete_volume(
+    name: str,
+    request: Request,
+    force: bool = Query(False),
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    vols = {v["name"]: v for v in volume_service.list_volumes()}
+    if name in vols and vols[name]["in_use"] and not force:
+        raise HTTPException(
+            status_code=409,
+            detail={
+                "error": "volume_in_use",
+                "detail": f"Volume '{name}' is used by: {', '.join(vols[name]['used_by'])}",
+            },
+        )
+    volume_service.remove_volume(name, force=force)
+    audit_service.record(
+        session, user=user.username, action="volume.delete", target=name, ip=_ip(request)
+    )
+    return {"ok": True}
+
+
+@router.post("/api/volumes/prune")
+def prune(
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    result = volume_service.prune_volumes()
+    audit_service.record(
+        session, user=user.username, action="volume.prune", target="*",
+        detail=str(result.get("VolumesDeleted")), ip=_ip(request),
+    )
+    return result
+
+
+@router.post("/api/volumes/generate-yaml")
+def generate_yaml(
+    spec: dict,
+    _user: User = Depends(get_current_user),
+) -> dict:
+    try:
+        return {"yaml": volume_service.generate_yaml(spec)}
+    except (KeyError, ValueError) as exc:
+        raise HTTPException(status_code=400, detail=f"Invalid volume spec: {exc}") from exc
+
+
+# --------------------------------------------------------------------------- #
+# Host path browser
+# --------------------------------------------------------------------------- #
+
+
+@router.get("/api/host/paths")
+def host_paths(
+    path: str = Query("/"),
+    show_hidden: bool = Query(False),
+    _user: User = Depends(get_current_user),
+) -> dict:
+    try:
+        return device_service.browse(path, show_hidden)
+    except device_service.BrowseError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc