feat: per-stack Reinstall + fix stack ownership enforcement

- API: stack-action/stack-remove now verify ownership for non-admin users
- API: add stack-reinstall action (pull latest images → down → up)
- User panel: add Reinstall button per stack; fix bug where remove-stack was called instead of stack-remove
- Admin panel: add Reinstall button per stack + dockerStackReinstall() handler
- User panel: Remove All My Apps now only removes the calling user's own containers/stacks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

panel/public/assets/js/admin.js

@@ -4143,6 +4143,7 @@ ${stacks.map(s=>`<tr>
     <button class="btn btn-xs btn-success" onclick="dockerStackAct(${s.id},'up')">Up</button>
     <button class="btn btn-xs btn-warning" onclick="dockerStackAct(${s.id},'down')">Down</button>
     <button class="btn btn-xs btn-ghost" onclick="dockerStackAct(${s.id},'logs')">Logs</button>
+    <button class="btn btn-xs btn-secondary" onclick="dockerStackReinstall(${s.id})">Reinstall</button>
     <button class="btn btn-xs btn-danger" onclick="dockerStackRemove(${s.id})">Remove</button>
   </td>
 </tr>`).join('')}
@@ -4301,6 +4302,13 @@ window.dockerStackAct = async (id, action) => {
   }
 };
 
+window.dockerStackReinstall = (id) => Nova.confirm('Reinstall this stack? Latest images will be pulled and containers restarted. Data volumes are preserved.', async () => {
+  Nova.toast('Reinstalling stack…', 'info', 15000);
+  const r = await Nova.api('docker', 'stack-reinstall', { method: 'POST', body: { stack_id: id } });
+  Nova.toast(r?.success ? 'Stack reinstalled' : (r?.message||'Reinstall failed'), r?.success?'success':'error');
+  if (r?.success) dockerLoadTab('stacks');
+}, true);
+
 window.dockerStackRemove = (id) => Nova.confirm('Remove this stack? Docker Compose down will be run first.', async () => {
   const r = await Nova.api('docker', 'stack-remove', { method: 'DELETE', body: { stack_id: id } });
   Nova.toast(r?.success ? 'Stack removed' : (r?.message||'Failed'), r?.success?'success':'error');