security+feat: v1.3.0 — pentest remediation, container reliability, UI overhaul

Security (33 pentest findings addressed):
- CRITICAL: backend binds 127.0.0.1, path traversal in tor.rs/dwn fixed
- HIGH: federation requires signatures, XSS login redirect, RBAC viewer restricted
- HIGH: tar slip prevention, S3 SSRF validation, backup ID validation
- MEDIUM: remember-me random secret, TOTP session rotation, password re-auth
- LOW: CSP unsafe-inline removed, CORS dev-only, onion/webhook validation

Container reliability:
- Memory limits on all 37 containers (OOM prevention)
- Exited vs stopped state distinction with health-aware status badges
- Crash recovery coordination (no more restart cascade)
- User-stopped tracking survives reboots
- Tiered boot recovery (databases → core → services → apps)

UI:
- Wallet TransactionsModal, health-aware app status badges
- Restart button on containers, exited/crashed red state
- Mesh view overhaul, glass button updates, BaseModal/ToggleSwitch
- Apps sticky header removed, dev faucet, mutable mock wallet

Infrastructure:
- LND REST port 8080 exposed over Tor (LND Connect fix)
- Nginx cookie_session fix, deploy script Tor config updated
- Dev environment: podman auto-start, boot mode simulation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/package.rs

@@ -686,6 +686,12 @@ printtoconsole=1\n", rpc_pass);
             sorted
         };
 
+        // Clear user-stopped flag — user explicitly started this app
+        crate::crash_recovery::clear_user_stopped(&self.config.data_dir, package_id).await;
+        for name in &to_start {
+            crate::crash_recovery::clear_user_stopped(&self.config.data_dir, name).await;
+        }
+
         for name in to_start {
             let _ = tokio::process::Command::new("podman")
                 .args(["start", &name])
@@ -707,9 +713,13 @@ printtoconsole=1\n", rpc_pass);
             .ok_or_else(|| anyhow::anyhow!("Missing package id"))?;
         validate_app_id(package_id)?;
 
+        // Mark as user-stopped so health monitor and crash recovery don't auto-restart
+        crate::crash_recovery::mark_user_stopped(&self.config.data_dir, package_id).await;
+
         let containers = get_containers_for_app(package_id).await?;
         if containers.is_empty() {
             let container_name = format!("archy-{}", package_id);
+            crate::crash_recovery::mark_user_stopped(&self.config.data_dir, &container_name).await;
             let _ = tokio::process::Command::new("podman")
                 .args(["stop", &container_name])
                 .output()
@@ -717,6 +727,9 @@ printtoconsole=1\n", rpc_pass);
             return Ok(serde_json::Value::Null);
         }
 
+        for name in &containers {
+            crate::crash_recovery::mark_user_stopped(&self.config.data_dir, name).await;
+        }
         for name in containers {
             let _ = tokio::process::Command::new("podman")
                 .args(["stop", &name])
@@ -1025,6 +1038,7 @@ printtoconsole=1\n", rpc_pass);
 fn create_installing_entry(package_id: &str) -> PackageDataEntry {
     PackageDataEntry {
         state: PackageState::Installing,
+        health: None,
         static_files: StaticFiles {
             license: String::new(),
             instructions: String::new(),