[SandObserver]

Summary

• Add ui/js/yaml-lite.js, an indentation-only YAML subset parser with no dependency, which throws with the offending line number on tabs, anchors and aliases, merge keys, flow collections, block scalars and multi-document files rather than mis-parsing them.
• Add ui/js/import-foreign.js, pure conversion from gethomepage services.yaml and bookmarks.yaml and Dashy conf.yml into app and folder items, reusing buildAppItem, newItemId and isSafeLinkUrl rather than restating the item shape or the link rule.
• Detect the source format from the parsed shape rather than the filename, including the extra list level that separates a bookmarks file from a services file.
• Map siteMonitor, and Dashy statusCheck/statusCheckUrl/statusCheckAllowInsecure, onto monitoring.healthcheck and skipTlsVerify; import a Homepage container only when no server key names another daemon.
• Skip items whose href is unsafe, unresolvable ({{HOMEPAGE_VAR_}}, ${}) or has no scheme, so a save cannot be refused wholesale by one bad link, and report every skip with a machine-readable reason.
• Blank icons the page cannot render: icon fonts, emoji, another dashboard's local paths, and absolute URLs on hosts the img-src policy refuses.
• Add ui/js/modal.js, one focus-trapped dialog used by the import preview, the folder picker and the new-folder prompt, replacing confirm() and prompt() and removing the duplicate focus trap in admin.js; rename the .fp-* styles to .dlg-*.
• Append imported items to the config read immediately before the write, so a change made in another tab while the preview is open is not overwritten, and return a result from save() so a failed write is no longer reported as success.
• Add a Backup row accepting multiple .yml/.yaml files, previewing apps, folders, per-item changes and skips before anything is written, and abort the whole batch if any file fails to parse.
• Add the strings to all six locales.

Testing
All green: 1086 backend, 606 frontend, 94.81% line coverage, lint, format, both typechecks, paths:check, cache-busting and the Docker build. Added 41 tests across the parser, the converter and a fixture suite that runs three configs exported from gethomepage 1.x and Dashy 4.5.7 containers, whose parse output was checked byte-for-byte against js-yaml.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.