fix: add prompts/templates to backup + STDIO attach for docker-image servers

Two bugs fixed:

1. Backup completeness: JSON backup API now includes prompts and
   templates. Previously these were silently dropped during
   backup/restore, causing data loss on migration.

2. STDIO proxy for docker-image servers: servers with dockerImage
   but no packageName/command (like docmost) now use k8s Attach
   to connect to the container's PID 1 stdin/stdout instead of
   exec. This fixes "has no packageName or command" errors.

Changes:
- backup-service.ts: add BackupPrompt/BackupTemplate types, export them
- restore-service.ts: restore prompts (with project FK) and templates
- mcp-proxy-service.ts: sendViaPersistentAttach for docker-image STDIO
- orchestrator.ts: add attachInteractive to McpOrchestrator interface
- kubernetes-orchestrator.ts: implement attachInteractive via k8s Attach
- k8s-client-official.ts: expose Attach client

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

templates/unifi-network.yaml

@@ -0,0 +1,25 @@
+name: unifi-network
+version: "1.0.0"
+description: UniFi Network MCP server for managing UniFi network devices, clients, and configuration
+packageName: "unifi-network-mcp"
+runtime: python
+transport: STDIO
+repositoryUrl: https://github.com/sirkirby/unifi-mcp
+# Health check disabled: STDIO health probe requires packageName (npm-based servers).
+# This server uses the Python runner. Probe support for Python runner STDIO servers is TODO.
+env:
+  - name: UNIFI_HOST
+    description: UniFi controller hostname or IP (e.g. unifi.example.com — without https://)
+    required: true
+  - name: UNIFI_USERNAME
+    description: UniFi local admin username
+    required: true
+  - name: UNIFI_PASSWORD
+    description: UniFi admin password
+    required: true
+  - name: UNIFI_NETWORK_PORT
+    description: UniFi controller port (default 443, use 8443 for standalone UniFi Controller)
+    required: false
+  - name: UNIFI_NETWORK_VERIFY_SSL
+    description: Verify SSL certificate (true/false, default true — set false for self-signed certs)
+    required: false