Phase 10: iGPU passthrough — render/video group GID detection (0.10.0)

- gpu_service: detect host render/video group GIDs from /dev/dri node ownership
  (render node → render GID, paired card node → video GID); added to GPUInfo +
  exposed via /api/system/gpus. inject_dri now emits numeric group_add entries
  (e.g. ["991","44"]) when GIDs are known, falling back to names otherwise;
  remove_gpu strips those GIDs + LIBVA_DRIVER_NAME; dri_group_gids() for cleanup.
- editor set-gpu passes render_gid/video_gid through; GPUSelector shows detected
  GIDs, defaults video group on, and sends them.

Verified: py_compile, unit check (inject→["991","44"] then clean removal),
frontend tsc build, image imports. Live iGPU verify is on the user's hardware.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/services/compose_edit_service.py

@@ -84,7 +84,12 @@ def set_gpu(yaml_str: str, service: str, config: dict) -> str:
     svc = _get_service(data, service)
     mode = config.get("mode", "none")
 
-    gpu_service.remove_gpu(svc)
+    # Detect host iGPU group GIDs so we can both inject and clean them up.
+    try:
+        dri_gids = gpu_service.dri_group_gids()
+    except Exception:  # noqa: BLE001 - detection is best-effort
+        dri_gids = set()
+    gpu_service.remove_gpu(svc, dri_gids)
 
     if mode == "nvidia":
         gpu_service.inject_nvidia(
@@ -100,6 +105,8 @@ def set_gpu(yaml_str: str, service: str, config: dict) -> str:
             add_render_group=config.get("add_render_group", True),
             add_video_group=config.get("add_video_group", False),
             set_libva=config.get("set_libva", False),
+            render_gid=config.get("render_gid"),
+            video_gid=config.get("video_gid"),
         )
     return _dump(data)