Merge ngit external-access PR 79ca68c1 into combined UAT candidate

Preserve current maintenance/session guards, Firewall UI and existing catalogs.
Retain scoped guest access, publishing journeys and local Blossom integration.
Normalize Blossom/router memory units to supported quadlet suffixes.

Validation: 108 dashboard tests, 10 gateway policy tests, strict source catalog
check. Integrated isolated backend qualification remains required before main.

app-catalog/catalog.json

@@ -715,6 +715,31 @@
       "tier": "optional",
       "icon": "/assets/img/app-icons/gashboard.svg",
       "repoUrl": "https://gitworkshop.dev/npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg/relay.ngit.dev/archy"
+    },
+    {
+      "id": "blossom",
+      "author": "hzrd149 / Archipelago",
+      "requires": [],
+      "tier": "optional",
+      "title": "Blossom",
+      "version": "6.4.1-archy.2",
+      "description": "Local file storage for Nostr and websites, using your Archipelago signer. External publishing is a separate explicit choice.",
+      "dockerImage": "localhost/archipelago-blossom:6.4.1-archy.2",
+      "category": "data",
+      "repoUrl": "https://github.com/hzrd149/blossom-server",
+      "icon": "/assets/img/app-icons/blossom.svg"
+    },
+    {
+      "id": "public-web-router",
+      "author": "Archipelago",
+      "requires": [],
+      "tier": "optional",
+      "title": "Public Web Router",
+      "version": "0.1.0",
+      "description": "Connect explicitly published websites to your own public gateway. HTTPS keys stay on this node. Configure routes through Setup.",
+      "dockerImage": "localhost/archipelago-public-web-router:0.1.0",
+      "category": "networking",
+      "icon": "/assets/img/app-icons/nginx.svg"
     }
   ]
 }