feat: watchtower tracking, dev environment, security logs page

- watchtower: docker-compose with label filtering, email notifications
- watchtower labels on navidrome, openclaw, immich services
- dev env: docker-compose.dev.yml (port 4001), deploy-dev.yml CI workflow
- dev.nas.jimmygan.com Caddy site block with Authelia forward_auth
- security page: backend router parsing Authelia/Caddy container logs
- security page: frontend with stats cards, timeline, top IPs, event log
- wired security route into App.svelte and Sidebar

.gitea/workflows/deploy-dev.yml

@@ -0,0 +1,22 @@
+name: Deploy Dashboard (Dev)
+on:
+  push:
+    branches: [dev]
+    paths:
+      - 'dashboard/**'
+      - '.gitea/workflows/**'
+
+jobs:
+  deploy-dev:
+    runs-on: ubuntu-latest
+    container:
+      volumes:
+        - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
+        - /volume1/docker/nas-dashboard:/nas-dashboard
+    steps:
+      - name: Checkout dev branch
+        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+      - name: Build dev image
+        run: DOCKER_BUILDKIT=0 docker build -t nas-dashboard-dev:latest dashboard/
+      - name: Deploy dev
+        run: docker compose -f /nas-dashboard/docker-compose.dev.yml up -d --pull never