Add Authentik SSO, budget visibility, Resend email, 12h item default

Opens Veola up to more users (Parodia's Authentik) and makes Apify spend
visible to everyone.

- Auth: Traefik forward-auth (trust X-Authentik-* headers only from
  trusted_proxies CIDRs, keyed by email, role synced from admin_group),
  keeping local password login as break-glass. New [auth] config,
  CaptureDirectIP + ForwardAuth middleware, deploy/authentik-forward-auth.md.
- Budget: count every Apify run (apify_api_usage table) and show
  calls + estimated cost to all users on the dashboard, with an optional
  monthly-budget bar. New [budget] config + settings.
- Email: Resend client for opt-in deal alerts and a weekly digest
  (Mon 09:00). Per-user email + toggles on Settings. New [resend] config.
- Defaults: new items default to a 12-hour poll interval to cut spend.

users table gains email/auth_source/email-pref columns (migrated in place).
go build/vet/test green; boots and migrates cleanly.

internal/handlers/dashboard.go

@@ -63,11 +63,19 @@ func (a *App) dashboardData(r *http.Request) (templates.DashboardData, error) {
 	if err != nil {
 		return templates.DashboardData{}, err
 	}
+	apifyToday, apifyMonth, costPerCall, monthlyBudget := a.Scheduler.ApifyUsage(r.Context())
+	ebayUsed, ebayLimit := a.Scheduler.EbayUsage(r.Context())
 	return templates.DashboardData{
-		Page:          a.page(r, "Dashboard", "dashboard"),
-		Stats:         stats,
-		RecentResults: rrs,
-		RecentAlerts:  alerts,
+		Page:             a.page(r, "Dashboard", "dashboard"),
+		Stats:            stats,
+		RecentResults:    rrs,
+		RecentAlerts:     alerts,
+		ApifyToday:       apifyToday,
+		ApifyMonth:       apifyMonth,
+		ApifyCostPerCall: costPerCall,
+		MonthlyBudget:    monthlyBudget,
+		EbayToday:        ebayUsed,
+		EbayLimit:        ebayLimit,
 	}, nil
 }