`Automatic` documentation update

docs(git_cdn): add GCDN001 help header/footer markdown

module_git_cdn (id GCDN001) had a config.software.json entry but no
help header/footer markdown. Add them in the APT001 (apt-cacher-ng)
style: overview + key features in the header, tabbed access / client
config / directories / logs in the footer.

Signed-off-by: Igor Pecovnik <igor@armbian.com>

software: tune git_cdn runtime envs (cache size, workers, depth, bundle)

Pass the proven git_cdn env vars on container run:
- PACK_CACHE_SIZE_GB=500 and GUNICORN_WORKER=12 (exposed as module options;
  workers otherwise defaults to host cpu_count())
- PACK_CACHE_DEPTH=true to cache shallow clones
- CDN_BUNDLE_URL="" to disable the upstream Android/AOSP clone-bundle
  default, irrelevant for a GitHub proxy

Verified every name/value against git_cdn source.

module_aptcacherng: use current ghcr.io/armbian image

Replace the abandoned sameersbn/apt-cacher-ng:3.3-20200524 (2020) image
with ghcr.io/armbian/apt-cacher-ng:latest, built from debian trixie
(apt-cacher-ng 3.7.x) by armbian/docker-armbian-build. This fixes the
reliability problems (stale/corrupt indexes, 503s under concurrent load,
broken HTTPS repos) that came from the dead 3.3 image.

Cache path and foreground run are unchanged, so install/remove/purge/
status all work as before. Author updated to @igorpecovnik since we now
build the image.

Signed-off-by: Igor Pecovnik <igor@armbian.com>

Add module_aptcacherng: apt-cacher-ng caching proxy

Single-container module wrapping sameersbn/apt-cacher-ng:3.3-20200524.
Caches Debian / Ubuntu .deb downloads on the LAN so each apt fetch from
upstream mirrors only happens once.

Wiring:

- tools/modules/software/module_aptcacherng.sh — install / remove /
  purge / status / help, same shape as module_qbittorrent /
  module_netbox. Cache lives at ${SOFTWARE_FOLDER}/apt-cacher-ng/cache
  so the purge action cleans it up correctly.

- tools/json/config.software.json — APT001 / APT002 / APT003 entries
  under Software → Management (next to NetBox), with the standard
  install / remove / purge triplet and a container_type=docker hint.

- tools/modules/runtime/config.runtime.sh — runtime URL hook so the
  Management menu links straight to the acng-report.html hit-rate page
  once the container is installed.

- tools/include/markdown/APT001-header.md + APT001-footer.md — the
  per-menu-ID header/footer pair the docs system splices into the
  rendered page (same convention as NBOX01 / FIL001).

fix(runners): use valid curl --create-dirs flag

curl has no --create-dir option; the correct long form is
--create-dirs. Newer curl (Debian trixie, 8.x) rejects the unknown
option outright and aborts the runner tarball download, leaving the
install with no tarball to unpack. Older curl builds tolerated it.

Signed-off-by: Igor Pecovnik <igor@armbian.com>

fix(runners): handle missing HOME in systemd hooks for runner-clean-p…

…ages

Systemd ExecStartPre/ExecStopPost hooks don't always propagate the HOME
environment variable even when running as the service user. This caused
runner-clean-pages to fail with "HOME is not set" error, leaving stale
_diag/pages/<uuid>.log files that collide on the next job.

Fix by deriving the home directory from /etc/passwd when HOME is unset.

Also documents the event-driven cleanup layer in README.md.

desktops: run DE postinst scripts in build chroot (fix missing wallpa…

…per)

The skip-in-container guard at module_desktop_branding.sh:135 was
dropping the entire DE postinst on every GHA rootfs build (and any
build inside Docker, which is the framework's default). Effect: GNOME
images shipped without the dconf override that pins the Armbian
wallpaper, the Armbian favorites in the shell dash, the touchpad
click-method default, etc. — all the chroot-safe setup gnome.sh
postinst was supposed to bake into the rootfs.

The postinst scripts are mostly file writes:
  - gnome.sh:   /etc/dconf/db/local.d/00-bg + dconf update
  - xfce.sh:    sed-edits /etc/skel xfce4-perchannel xml + menu xml
  - mate.sh:    /etc/dconf override + glib-compile-schemas
  - budgie.sh:  /etc/dconf override
None of them call systemctl, dbus, or gsettings against a live
session, so chroot is the wrong place to gate them. Real runtime-
sensitive operations (DM start, netplan apply, gsettings against a
running dbus) live in module_desktops.sh under their own
_desktop_in_container guards.

Run postinst unconditionally. Keep dialog_infobox gated so CI
doesn't try to render an ncurses dialog.

desktops: install libcamera/v4l userspace at minimal tier (#924)

Modern laptops with complex ISPs (Intel IPU3/6/7, Qualcomm Snapdragon
X) enumerate /dev/video* at the kernel level but require userspace
pipeline plumbing (libcamera + PipeWire camera shim + GStreamer
libcamera plugin) before any app can show a live image. Without
these packages, GNOME Snapshot / Cheese / Firefox / Chrome see no
camera even when one is physically present and the kernel module is
bound.

Add at minimal tier so the userspace stack is ready as soon as
upstream libcamera lands the right pipeline handler for a given
machine. Inert on machines without a camera - the daemons stay idle.

Verified across noble / resolute / trixie / bookworm at amd64
minimal - all three packages resolve cleanly.

Note: on bleeding-edge SKUs (e.g. ThinkPad X9-15 Gen 1, Lunar Lake
IPU7), the camera still won't work because upstream libcamera 0.7
lacks an IPU7 pipeline handler - Intel/Canonical ship those out of
tree. When that lands in mainline libcamera and propagates to
Debian/Ubuntu, every Armbian desktop install on these laptops will
just work on the next apt upgrade. This is the cheap pre-stage.

module_cockpit: drop qemu-kvm (no riscv64 build; qemu-system covers it)

Install failed on riscv64 with:
  Package qemu-kvm is not available, but is referred to by another package.
  ...
  E: Package 'qemu-kvm' has no installation candidate

qemu-kvm is a legacy x86-leaning meta package - Debian / Ubuntu only
publish it for amd64 (and historically arm64). On riscv64 there is no
qemu-kvm; the equivalent on every arch is qemu-system, which is
already in the package list right next to it. qemu-system is the
arch-agnostic meta that pulls in qemu-system-<host-arch>
(qemu-system-riscv64 on riscv64, qemu-system-x86 on amd64, etc.) -
exactly what libvirt + cockpit-machines need.

Drop qemu-kvm from both pkg_install and pkg_remove; functionality
unchanged on amd64/arm64, install now succeeds on riscv64.