feat: watchtower tracking, dev environment, security logs page

- watchtower: docker-compose with label filtering, email notifications
- watchtower labels on navidrome, openclaw, immich services
- dev env: docker-compose.dev.yml (port 4001), deploy-dev.yml CI workflow
- dev.nas.jimmygan.com Caddy site block with Authelia forward_auth
- security page: backend router parsing Authelia/Caddy container logs
- security page: frontend with stats cards, timeline, top IPs, event log
- wired security route into App.svelte and Sidebar

tmp_remote/Caddyfile_nas

@@ -61,6 +61,17 @@ ldap.jimmygan.com {
         reverse_proxy 127.0.0.1:17170
 }
 
+dev.nas.jimmygan.com {
+	tls {
+		dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+	}
+	forward_auth 127.0.0.1:9092 {
+		uri /api/verify?rd=https://auth.jimmygan.com:8443
+		copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+	}
+	reverse_proxy 127.0.0.1:4001
+}
+
 git.jimmygan.com {
         tls {
                 dns cloudflare {env.CLOUDFLARE_API_TOKEN}