feat(devicebackup): run the guestmount urbackup image with kvm + fuse

Switch the urbackup service to registry.ginnoir.com/ginnoir/urbackup-server
(built in 3615c9b) and pass /dev/fuse, /dev/kvm and SYS_ADMIN so the server
enables image mounting for single-file restores.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/devicebackup/README.md

@@ -33,7 +33,8 @@ Register a new Portainer git stack → `stacks/devicebackup` (one-time), then pu
 - **General → Soft filesystem quota:** `3500G`.
 - **Client defaults → Image backups:** incremental every 1 day, full every 30 days;
   keep min 2 / max 4 full images, min 7 / max 30 incrementals. Volumes `ALL_NONUSB` (with ESP).
-- **Client defaults → File backups:** off (images are browsable and mountable for single-file restores).
+- **Client defaults → File backups:** off. Single-file restores come from mounting an image in the web UI, which needs guestmount; the stock image lacks it, so this stack runs a custom build (`urbackup/Dockerfile`) with `/dev/kvm` + `/dev/fuse`.
+- **Applied 2026-10-01** via the web API (`/x?a=settings`, `sa=general_save`). These settings live in `/config/urbackup`, not in this repo.
 - Leave UrBackup with **no admin user**: auth is Authentik forward_auth at Caddy, and 55414 is not
   published. Adding a UrBackup user just means logging in twice.