v1.13.0 — day-2 operations: stacks, rollback, node control, hardening checks

- Services are grouped by stack in the tree (stack → service → container),
  with per-stack roll-ups for in-flight updates and security findings.
  's' toggles grouping, 'h'/'l' fold across all three levels.
- Roll a service back to its previous version with 'R'; the confirm shows
  the spec diff reversed, so you see what will be undone. 'X' now removes
  a service straight from the tree.
- 'u' sets any version, not just an available upgrade — pin a service, or
  go back to a known-good tag, including off :latest.
- Nodes: 'a' sets availability (active / pause / drain, drain confirmed),
  and the node detail shows what the scheduler has booked against each
  node's CPU and memory — reservations, with tasks that declare none
  counted separately.
- The security scan grew from 2 checks to 8: Docker socket mounted in,
  added capabilities, host network, seccomp/AppArmor disabled, plus
  informational notes on missing resource limits and unpinned images.
- New Configs tab, showing a config's actual content — the thing the
  Secrets tab cannot do.
- Site: a third demo slide showing the TUI; docs updated throughout and
  Polish added as a fifth language.