Phase 21: container terminal (web exec), local + agent (0.27.0)

Interactive shell into a compose-managed container over WebSocket + xterm.js,
opened from the container card on the stack Overview tab. Admin-only (non-admin
handshake rejected with 4403); only containers with the compose project label
are reachable.

- backend services/exec_service.py: create/start/resize exec + a shared
  bidirectional pump_exec (recv/sendall on sock._sock, executor thread,
  resize control frames, exit-code frame).
- routers/ws.py: _authorize_admin + /ws/exec/{container_id} and the
  /ws/agent-exec/{agent_id}/{container_id} proxy (forwards BOTH directions).
- agent_app.py: /agent/ws/exec/{container_id}.
- frontend: @xterm/xterm + @xterm/addon-fit; ContainerTerminal modal (shell
  picker, fit/resize, exit/error handling) + a Terminal button on ContainerCard.

Live-verified (TestClient): local happy/exit/guard/4403/4401, agent happy/4401,
proxy bidirectional round-trip.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -153,6 +153,19 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
   container or connect any container on the host (`POST /api/networks/{id}/connect`
   / `/disconnect`).
 
+### Phase 21 — Container terminal (web exec)
+
+- An **interactive terminal** into any running, compose-managed container,
+  opened from the terminal button on its container card (stack Overview tab).
+  Streams an exec session over WebSocket into xterm.js — pick `/bin/sh`,
+  `/bin/bash`, or `/bin/ash`; full TTY with resize.
+- **Admin-only** (exec is root-equivalent): a non-admin token is rejected at the
+  WebSocket handshake (`4403`). Only containers with the
+  `com.docker.compose.project` label can be reached.
+- Works for **remote stacks** too: the same terminal proxies through
+  `/ws/agent-exec/{agent_id}/{container_id}` to the agent's new
+  `/agent/ws/exec/{container_id}` (bidirectional — keystrokes in, output out).
+
 ### Phase 20 — Container management
 
 - The stack **Overview** tab now renders each service as an expandable