feat: configurable unused images threshold with dashboard warning

- Add image_prune_threshold_mb setting (default 1024 MB)
- Add GET /api/docker/unused-images endpoint returning unused image count, size, and threshold status
- Dashboard shows amber warning banner when unused project images exceed threshold
- Banner links to settings page for pruning, shows count and human-readable size (MB/GB)
- Threshold configurable in Docker Image Cleanup section of settings
- DB migration + schema for image_prune_threshold_mb

internal/store/models.go

@@ -74,6 +74,7 @@ type Settings struct {
 	TraefikCertResolver string `json:"traefik_cert_resolver"`
 	TraefikNetwork      string `json:"traefik_network"`
 	TraefikAPIURL       string `json:"traefik_api_url"`
+	ImagePruneThresholdMB int  `json:"image_prune_threshold_mb"`
 	BackupEnabled       bool   `json:"backup_enabled"`
 	BackupIntervalHours  int    `json:"backup_interval_hours"`
 	BackupRetentionCount int    `json:"backup_retention_count"`

internal/store/settings.go

@@ -16,6 +16,7 @@ func (s *Store) GetSettings() (Settings, error) {
 		        cloudflare_api_token, cloudflare_zone_id,
 		        npm_remote, npm_access_list_id, proxy_provider,
 		        traefik_entrypoint, traefik_cert_resolver, traefik_network, traefik_api_url,
+		        image_prune_threshold_mb,
 		        backup_enabled, backup_interval_hours, backup_retention_count,
 		        updated_at
 		 FROM settings WHERE id = 1`,
@@ -26,6 +27,7 @@ func (s *Store) GetSettings() (Settings, error) {
 		&st.CloudflareAPIToken, &st.CloudflareZoneID,
 		&npmRemote, &st.NpmAccessListID, &st.ProxyProvider,
 		&st.TraefikEntrypoint, &st.TraefikCertResolver, &st.TraefikNetwork, &st.TraefikAPIURL,
+		&st.ImagePruneThresholdMB,
 		&backupEnabled, &st.BackupIntervalHours, &st.BackupRetentionCount,
 		&st.UpdatedAt)
 	if err != nil {
@@ -61,6 +63,7 @@ func (s *Store) UpdateSettings(st Settings) error {
 			cloudflare_api_token=?, cloudflare_zone_id=?,
 			npm_remote=?, npm_access_list_id=?, proxy_provider=?,
 			traefik_entrypoint=?, traefik_cert_resolver=?, traefik_network=?, traefik_api_url=?,
+			image_prune_threshold_mb=?,
 			backup_enabled=?, backup_interval_hours=?, backup_retention_count=?,
 			updated_at=?
 		 WHERE id = 1`,
@@ -71,6 +74,7 @@ func (s *Store) UpdateSettings(st Settings) error {
 		st.CloudflareAPIToken, st.CloudflareZoneID,
 		npmRemote, st.NpmAccessListID, st.ProxyProvider,
 		st.TraefikEntrypoint, st.TraefikCertResolver, st.TraefikNetwork, st.TraefikAPIURL,
+		st.ImagePruneThresholdMB,
 		backupEnabled, st.BackupIntervalHours, st.BackupRetentionCount,
 		st.UpdatedAt,
 	)

internal/store/store.go

@@ -121,6 +121,8 @@ func (s *Store) runMigrations() error {
 		`ALTER TABLE projects ADD COLUMN npm_access_list_id INTEGER NOT NULL DEFAULT 0`,
 		// Separate public IP for DNS A records.
 		`ALTER TABLE settings ADD COLUMN public_ip TEXT NOT NULL DEFAULT ''`,
+		// Image prune threshold (MB). Warn on dashboard when exceeded. 0 = disabled.
+		`ALTER TABLE settings ADD COLUMN image_prune_threshold_mb INTEGER NOT NULL DEFAULT 1024`,
 	}
 
 	for _, m := range migrations {
@@ -225,6 +227,7 @@ CREATE TABLE IF NOT EXISTS settings (
 	base_volume_path   TEXT NOT NULL DEFAULT '',
 	ssl_certificate_id     INTEGER NOT NULL DEFAULT 0,
 	npm_remote             INTEGER NOT NULL DEFAULT 0,
+	image_prune_threshold_mb INTEGER NOT NULL DEFAULT 1024,
 	npm_access_list_id     INTEGER NOT NULL DEFAULT 0,
 	traefik_entrypoint     TEXT NOT NULL DEFAULT 'websecure',
 	traefik_cert_resolver  TEXT NOT NULL DEFAULT 'letsencrypt',