feat (helper): daemon-reload via helper; verwijder D-Bus afhankelijkheid

- podman-helper: voeg daemon-reload toe aan ALLOWED_ACTIONS; actions
  in NO_UNIT_ACTIONS slaan unit-validatie over en bouwen cmd zonder
  unit argument
- app_system: /daemon-reload endpoint gebruikt nu _helper_call in
  plaats van directe subprocess; verwijder subprocess import
- app_system: health check legt systemd_reachable af van helper_ok
  in plaats van systemctl --user list-units — de helper draait als
  host-user en impliceert systemd bereikbaarheid
- CLAUDE.md: verwijder DBUS_SESSION_BUS_ADDRESS env var; D-Bus mount
  is niet meer nodig

Deploy: kopieer podman-helper.py naar host, daemon-reload, restart
helper, rebuild backend image, herstart container zonder bus mount.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

control/app_system.py

@@ -1,6 +1,5 @@
 import os
 import socket
-import subprocess
 
 from fastapi import APIRouter, HTTPException
 from common import (
@@ -29,19 +28,6 @@ def init_system_router(session, podman_api_base: str, workloads_dir: str) -> API
         except Exception:
             podman_ok = False
 
-        systemd_reachable = False
-        try:
-            res = subprocess.run(
-                ["systemctl", "--user", "list-units", "--no-pager", "--no-legend"],
-                capture_output=True,
-                text=True,
-                check=False,
-                timeout=2,
-            )
-            systemd_reachable = (res.returncode == 0)
-        except Exception:
-            systemd_reachable = False
-
         helper_ok = False
         try:
             with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as s:
@@ -51,7 +37,11 @@ def init_system_router(session, podman_api_base: str, workloads_dir: str) -> API
         except Exception:
             helper_ok = False
 
-        ok = podman_ok and systemd_reachable
+        # Helper draait op de host als de kodi-user en voert systemctl --user uit.
+        # Als de helper bereikbaar is, is systemd ook bereikbaar.
+        systemd_reachable = helper_ok
+
+        ok = podman_ok and helper_ok
         return {
             "ok": ok,
             "podman": {"ok": podman_ok},
@@ -92,7 +82,7 @@ def init_system_router(session, podman_api_base: str, workloads_dir: str) -> API
     @router.post("/daemon-reload")
     def api_daemon_reload():
         try:
-            code, out = _systemctl(["systemctl", "--user", "daemon-reload"])
+            code, out = _helper_call("daemon-reload", "")
             return {
                 "cmd": "systemctl --user daemon-reload",
                 "exit": code,