Add a Containers page, grouped by project and led by what is exposed

Every container on this machine is created by rootless podman-compose and
labelled with the project it belongs to, so the grouping is read from the
labels rather than invented. State then decides prominence within that
grouping -- running containers get rows, stopped ones collapse to a line --
which is why neither axis had to be chosen over the other.

Acting on a stack uses plain podman over the labelled set, never
`podman-compose down`, which would remove containers this shell did not
create. The compose file is the source of truth for what exists and belongs
to the repository. Nothing here needs privilege.

The findings on top are the crossing the Firewall page reports, seen from the
side that can close it: the firewall knows only that something is listening,
while this page knows which container, which compose file, and which token is
missing from it. So `bind-local` prepends a loopback address and leaves the
line byte-for-byte -- variables, quoting and style intact -- then re-parses and
rolls back unless exactly those ports moved. It refuses anything ambiguous
rather than guessing. Rewriting the mapping to the port podman reports today
would have deleted the ${POSTGRES_PORT} indirection that makes it
configurable at all.

Unused volumes are read from podman's own dangling filter. The first version
used MountCount, which is a runtime lock counter and not a usage signal: it
reads zero for a volume a running container has mounted this second, so
"remove unused volumes" offered to delete the live Command Center database.
The cross-check against `podman system df` is what exposed it. The contract
reintroduces that bug deliberately and fails if the guard does not catch it,
because a guard nobody has seen fail proves nothing.

Every mutation in the contract runs against a stubbed podman. Nothing in the
suite starts, stops or removes a real container, image or volume.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/quickshell/services/SettingsSearch.qml

@@ -79,6 +79,11 @@ Singleton {
         { label: "Open ports", detail: "Which ports the firewall permits", page: "firewall" },
         { label: "Firewall zones", detail: "Which rules apply to each network connection", page: "firewall" },
         { label: "Exposed services", detail: "What is listening and reachable from the network", page: "firewall" },
+        { label: "Containers", detail: "Rootless podman stacks you run for development", page: "containers" },
+        { label: "Podman", detail: "Running containers, images and volumes", page: "containers" },
+        { label: "Container logs", detail: "Follow what a container is printing", page: "containers" },
+        { label: "Reclaim container space", detail: "Remove images and volumes nothing uses", page: "containers" },
+        { label: "Published ports", detail: "Which containers are reachable from the network", page: "containers" },
         { label: "Remote login", detail: "Sign in to this machine over SSH", page: "sharing" },
         { label: "Remote desktop", detail: "See and control this desktop from elsewhere", page: "sharing" },
         { label: "Network name", detail: "The name other machines see", page: "sharing" },