feat: architecture review fixes, self-update system, CI pipeline, supply chain hardening

Architecture review (all P0+P1 issues now fixed):
- Add 10s timeout to 6 bare Nostr client.connect() calls
- Pin all 12 crypto deps to exact versions from Cargo.lock
- Pin all 15 floating container image tags to exact patch versions
- Add CI pipeline (cargo fmt + clippy + tests, frontend type-check + build)

Self-update system (git.tx1138.com):
- scripts/self-update.sh: pull, build, install, restart with rollback
- systemd timer checks daily at 3 AM
- update.check RPC does git-based checks when repo is present
- update.git-apply RPC triggers self-update from UI
- Default update URL changed from GitHub to git.tx1138.com
- Git added to ISO package list for fresh installs

Documentation:
- CHANGELOG v1.3.1 with all changes
- README updated (version, update system section)
- BETA-PROGRESS session #6 logged
- architecture-review.html: 4 issues marked FIXED, 8/12 refactoring done

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/nostr_discovery.rs

@@ -9,6 +9,7 @@ use anyhow::{Context, Result};
 use nostr_sdk::prelude::*;
 use std::net::SocketAddr;
 use std::path::Path;
+use std::time::Duration;
 use tokio::fs;
 
 /// Parse "host:port" to SocketAddr. Returns None if invalid.
@@ -110,7 +111,9 @@ pub async fn publish_node_revocation(
     for url in LEGACY_RELAYS {
         let _ = client.add_relay(*url).await;
     }
-    client.connect().await;
+    if tokio::time::timeout(Duration::from_secs(10), client.connect()).await.is_err() {
+        tracing::warn!("Nostr relay connection timed out after 10s, continuing anyway");
+    }
 
     // NIP-33 replaceable: empty content overwrites previous event
     let builder = EventBuilder::new(Kind::Custom(ARCHIPELAGO_KIND as u16), "{}")
@@ -197,7 +200,9 @@ pub async fn verify_revocation(
     for url in LEGACY_RELAYS {
         let _ = client.add_relay(*url).await;
     }
-    client.connect().await;
+    if tokio::time::timeout(Duration::from_secs(10), client.connect()).await.is_err() {
+        tracing::warn!("Nostr relay connection timed out after 10s, continuing anyway");
+    }
 
     let filter = Filter::new()
         .kind(Kind::Custom(ARCHIPELAGO_KIND as u16))
@@ -261,7 +266,9 @@ pub async fn discover_archipelago_nodes(
     for url in relays {
         let _ = client.add_relay(url).await;
     }
-    client.connect().await;
+    if tokio::time::timeout(Duration::from_secs(10), client.connect()).await.is_err() {
+        tracing::warn!("Nostr relay connection timed out after 10s, continuing anyway");
+    }
 
     let filter = Filter::new()
         .kind(Kind::Custom(ARCHIPELAGO_KIND as u16))