feat(devicebackup): run the guestmount urbackup image with kvm + fuse

Switch the urbackup service to registry.ginnoir.com/ginnoir/urbackup-server
(built in 3615c9b) and pass /dev/fuse, /dev/kvm and SYS_ADMIN so the server
enables image mounting for single-file restores.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

stacks/devicebackup/docker-compose.yml

@@ -13,13 +13,24 @@
 services:
   urbackup:
     container_name: urbackup
-    image: uroni/urbackup-server:2.5.x
+    # uroni/urbackup-server:2.5.x + libguestfs (guestmount) so image backups can be
+    # mounted for single-file restores. Built from urbackup/Dockerfile by
+    # .gitea/workflows/build-urbackup-server.yml.
+    image: registry.ginnoir.com/ginnoir/urbackup-server:latest
     restart: unless-stopped
     labels:
       - "com.centurylabs.watchtower.enable=false"
     networks: [edge]
     env_file:
       - stack.env
+    # guestmount boots a small KVM appliance and exposes the image over FUSE.
+    devices:
+      - /dev/fuse:/dev/fuse
+      - /dev/kvm:/dev/kvm
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - apparmor:unconfined
     volumes:
       - /config/urbackup:/var/urbackup
       - /storage1/labdata/urbackup:/backups