Deployments, auto deploy, service routes, live logs, metrics and a terminal

Deployments: deploy, restart and git sync now run in the background, one at
a time per app (a newer request replaces a queued one). Each run is recorded
in SQLite with its log, streamed to the UI while it runs, and can be
cancelled. Any earlier deployment can be deployed again, which rolls back to
its commit, or to its saved compose file for compose apps.

Auto deploy: POST /hooks/<app>, verified with the app's secret (Forgejo,
Gitea and GitHub HMAC signatures, or the secret as a token for CI). With a
Forgejo token stored, the panel adds the webhook to the repository itself.
The NixOS module routes /hooks/* past Authelia. Caddy matches the cleaned
path but forwards the original, so the panel refuses dot segments and only
accepts webhook deliveries from that route (tagged with X-Panel-Hook).

Domains: a route can point at a compose service's container port
("web:8080"). The panel picks a free 127.0.0.1 port and panelctl publishes
it through a generated .panel-ports.yaml override, so compose files need no
ports: section. Existing host:port upstreams keep working.

Logs stream live over server-sent events, with service and text filters.
A sampler keeps an hour of CPU and memory per container for the new
Monitoring tab. The Terminal tab opens `podman exec` in a container over a
WebSocket, using xterm.js bundled by the Nix package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf

README.md

@@ -2,6 +2,16 @@
 
 Minimal container management panel for rootless Podman + Caddy.
 
+- **Deployments** run in the background with a live log, a history per app
+  (the last 50, with their output), cancel, redeploy and one-click rollback to
+  an earlier commit or compose file.
+- **Auto deploy**: a push to the app's branch deploys it. The panel adds the
+  webhook to Forgejo itself; GitHub and CI use the shown URL and secret.
+- **Domains** point at a service's container port (`web:8080`); the panel
+  picks a free local port and publishes it, so compose files need no `ports:`.
+- **Live logs**, **CPU / memory graphs** per container and a **web terminal**
+  (`podman exec`) in the browser.
+
 ## Installing on NixOS
 
 This repository is a flake that provides the panel as a package
@@ -56,10 +66,13 @@ Checks (package build and a module evaluation) run with `nix flake check`.
 ```
 /var/lib/containers/
 ├── stacks/<app>/compose.yaml    # Compose file per app
+├── stacks/<app>/.panel-*.yaml   # Generated overrides: published route ports, env vars
 ├── volumes/<app>/data           # Persistent volumes
 ├── routes/routes.caddy          # Single aggregate Caddy routes file
 ├── backups/<app>-<timestamp>.zip # Volume backups
-└── state/apps/<app>.env         # App manifest
+├── state/apps/<app>.env         # App manifest
+└── state/panel/                 # Panel state: panel.db (deployment history),
+                                 # deployments/<app>/<id>.log, webhook secrets, keys
 ```
 
 All app routes are written to a single `routes/routes.caddy` file that Caddy imports.