Phase 10: iGPU passthrough — render/video group GID detection (0.10.0)

- gpu_service: detect host render/video group GIDs from /dev/dri node ownership
  (render node → render GID, paired card node → video GID); added to GPUInfo +
  exposed via /api/system/gpus. inject_dri now emits numeric group_add entries
  (e.g. ["991","44"]) when GIDs are known, falling back to names otherwise;
  remove_gpu strips those GIDs + LIBVA_DRIVER_NAME; dri_group_gids() for cleanup.
- editor set-gpu passes render_gid/video_gid through; GPUSelector shows detected
  GIDs, defaults video group on, and sends them.

Verified: py_compile, unit check (inject→["991","44"] then clean removal),
frontend tsc build, image imports. Live iGPU verify is on the user's hardware.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -6,7 +6,7 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
 > **Status:** Phase 1 (Core) + Phase 2 (Volumes & GPU) + Phase 3 (Quality of
 > Life) + Phase 4 (Operations) + Phase 5 (Multi-host) + Phase 6 (Backup
 > destinations) + Phase 7 (Scheduled backups) + Phase 8 (Remote-stack backups)
-> + Phase 9 (Networks) complete.
+> + Phase 9 (Networks) + Phase 10 (iGPU passthrough) complete.
 
 ## What works today (Phase 1)
 
@@ -122,6 +122,15 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
 - **Stack delete**: local stacks can now be deleted from the UI (stack detail and
   the stack card), with a confirm dialog and an optional "keep files on disk".
 
+### Phase 10 — iGPU passthrough
+
+- **Render/video group detection**: for a passed-through Intel/AMD iGPU, StackPilot
+  reads the host group ownership of the `/dev/dri` nodes (render node → `render`
+  GID, paired `card` node → `video` GID) and injects them as **numeric**
+  `group_add` entries (e.g. `group_add: ["991", "44"]`). Group names rarely
+  resolve inside images, so the numeric GID is what actually grants access. The
+  GPU selector shows the detected GIDs; removal cleans them (and `LIBVA_DRIVER_NAME`).
+
 ## Deploying an agent on another host
 
 ```bash