Add Authentik SSO, budget visibility, Resend email, 12h item default

Opens Veola up to more users (Parodia's Authentik) and makes Apify spend
visible to everyone.

- Auth: Traefik forward-auth (trust X-Authentik-* headers only from
  trusted_proxies CIDRs, keyed by email, role synced from admin_group),
  keeping local password login as break-glass. New [auth] config,
  CaptureDirectIP + ForwardAuth middleware, deploy/authentik-forward-auth.md.
- Budget: count every Apify run (apify_api_usage table) and show
  calls + estimated cost to all users on the dashboard, with an optional
  monthly-budget bar. New [budget] config + settings.
- Email: Resend client for opt-in deal alerts and a weekly digest
  (Mon 09:00). Per-user email + toggles on Settings. New [resend] config.
- Defaults: new items default to a 12-hour poll interval to cut spend.

users table gains email/auth_source/email-pref columns (migrated in place).
go build/vet/test green; boots and migrates cleanly.

static/css/app.css

@@ -474,3 +474,18 @@ table.v-table tbody tr:hover td { background: rgba(0, 164, 228, 0.08); }
   .v-just-swapped { animation: none; }
   .v-countdown-critical { animation: none; }
 }
+
+/* Budget progress bar (dashboard). Styled cross-browser without inline styles
+   so it stays within the strict CSP (no style-src 'unsafe-inline'). */
+.v-progress {
+  height: 0.6rem;
+  border-radius: 9999px;
+  overflow: hidden;
+  -webkit-appearance: none;
+  appearance: none;
+  border: 1px solid var(--border);
+  background: var(--surface-2);
+}
+.v-progress::-webkit-progress-bar { background: var(--surface-2); }
+.v-progress::-webkit-progress-value { background: var(--accent); }
+.v-progress::-moz-progress-bar { background: var(--accent); }