feat(oci): GPU selection per host and per image, one notification per update, and App tab for stack containers

- Immich asks what runs its video and its recognition in one menu, in both
  modes, and gives the GPU to the server and to Machine learning; AMD uses ROCm
- Frigate, Ollama, llama.cpp, Faster Whisper and Piper take the image built
  for the chosen GPU
- The acceleration menu offers only what the host can run
- An update or a recreation sends one notification with its result instead of
  the stop, backup and start of each container
- A private bridge with nothing connected is not reported as down
- Secondary containers of a stack appear in the App tab with their version and
  logo; Secure Gateway shows the same update state in both views
- A mistyped value in the wizard asks the same question again

AppImage/components/secure-gateway-setup.tsx

@@ -162,6 +162,19 @@ export function SecureGatewaySetup() {
     loadInitialData()
   }, [])
 
+  // The gateway was updated from the Updates tab of its container: read the
+  // update state and the status again so this card agrees with it.
+  useEffect(() => {
+    const refresh = (event: Event) => {
+      const detail = (event as CustomEvent).detail || {}
+      if (detail.appId !== "secure-gateway" || detail.source === "card") return
+      void loadUpdateInfo(true)
+      void loadStatus()
+    }
+    window.addEventListener("proxmenuxManagedAppUpdated", refresh)
+    return () => window.removeEventListener("proxmenuxManagedAppUpdated", refresh)
+  }, [])
+
   const loadInitialData = async () => {
     setLoading(true)
     setLoadError(null)
@@ -288,6 +301,8 @@ export function SecureGatewaySetup() {
         // Status may briefly show "stopped" if tailscale was restarted —
         // refresh that too so the action buttons render the right state.
         await loadStatus()
+        // The Updates tab of the gateway container reads it again.
+        window.dispatchEvent(new CustomEvent("proxmenuxManagedAppUpdated", { detail: { appId: "secure-gateway", source: "card" } }))
       } else {
         setUpdateError(res?.message || sg("errors.updateFailed"))
       }