feat: watchtower tracking, dev environment, security logs page

- watchtower: docker-compose with label filtering, email notifications
- watchtower labels on navidrome, openclaw, immich services
- dev env: docker-compose.dev.yml (port 4001), deploy-dev.yml CI workflow
- dev.nas.jimmygan.com Caddy site block with Authelia forward_auth
- security page: backend router parsing Authelia/Caddy container logs
- security page: frontend with stats cards, timeline, top IPs, event log
- wired security route into App.svelte and Sidebar

dashboard/backend/main.py

@@ -5,7 +5,7 @@ from fastapi.responses import JSONResponse
 from slowapi import Limiter
 from slowapi.util import get_remote_address
 from slowapi.errors import RateLimitExceeded
-from routers import docker_router, gitea, files, terminal, system, auth, chat_summary
+from routers import docker_router, gitea, files, terminal, system, auth, chat_summary, security
 import auth as auth_module
 
 import asyncio
@@ -148,6 +148,7 @@ app.include_router(gitea.router, prefix="/api/gitea", dependencies=[Depends(auth
 app.include_router(files.router, prefix="/api/files", dependencies=[Depends(auth_module.get_current_user)])
 app.include_router(system.router, prefix="/api/system", dependencies=[Depends(auth_module.get_current_user)])
 app.include_router(chat_summary.router, prefix="/api/chat-summary", dependencies=[Depends(auth_module.get_current_user)])
+app.include_router(security.router, prefix="/api/security", dependencies=[Depends(auth_module.get_current_user)])
 
 # WebSocket endpoint (auth handled inside handler via Query param)
 app.add_api_websocket_route("/ws/terminal", terminal.ws_endpoint)