feat: managed NUT setup, plugin config improvements, migration fix

- Add managed NUT mode: configure NUT daemon from Settings → Plugins
  (UPS plugin), writes /data/nut_managed.json read by entrypoint on
  restart — no env vars or USB passthrough required
- entrypoint.sh: start NUT from /data/nut_managed.json or NUT_MANAGED=1
  env var; drop to app user via gosu after NUT daemons start
- nut_setup.py: support --from-file <json> in addition to env vars
- Dockerfile: add nut, nut-client, gosu packages and entrypoint
- docker-compose.yml: document optional NUT_MANAGED env var block
- Fix plugin hot-reload migration failure: pass all plugin migration
  dirs to Alembic so previously-stamped revisions from other plugins
  remain resolvable (fixes UPS and any plugin with depends_on)
- Fix plugin list-type config (e.g. SNMP devices) rendering as broken
  text input — now shows a read-only note to edit plugin.yaml instead
- Fix _sync_nut_managed_config: only write JSON when nut_ups_host is
  non-empty, preventing NUT startup loop on container restart

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -1,7 +1,13 @@
 FROM python:3.13-slim
 
 RUN DEBIAN_FRONTEND=noninteractive apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends iputils-ping \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        iputils-ping \
+        # NUT (Network UPS Tools) — only used when NUT_MANAGED=1
+        nut \
+        nut-client \
+        # gosu — minimal privilege-drop tool used by entrypoint.sh
+        gosu \
     && rm -rf /var/lib/apt/lists/*
 
 # Upgrade pip to suppress the version notice
@@ -14,14 +20,18 @@ COPY fabledscryer/ fabledscryer/
 RUN pip install --no-cache-dir .
 
 COPY alembic.ini .
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
-# Runtime directories — owned by app user
+# Runtime directories — owned by app user.
+# The container runs as root so the entrypoint can start NUT daemons (USB
+# access requires root); it drops to 'app' (uid 1000) via gosu before
+# launching fabledscryer.
 RUN useradd -m -u 1000 app \
     && mkdir -p /data/playbook_cache /data/plugins \
     && chown -R app:app /data /app
 
-USER app
-
 EXPOSE 5000
 
+ENTRYPOINT ["/entrypoint.sh"]
 CMD ["fabledscryer", "--host", "0.0.0.0", "--port", "5000"]