security+feat: v1.3.0 — pentest remediation, container reliability, UI overhaul

Security (33 pentest findings addressed):
- CRITICAL: backend binds 127.0.0.1, path traversal in tor.rs/dwn fixed
- HIGH: federation requires signatures, XSS login redirect, RBAC viewer restricted
- HIGH: tar slip prevention, S3 SSRF validation, backup ID validation
- MEDIUM: remember-me random secret, TOTP session rotation, password re-auth
- LOW: CSP unsafe-inline removed, CORS dev-only, onion/webhook validation

Container reliability:
- Memory limits on all 37 containers (OOM prevention)
- Exited vs stopped state distinction with health-aware status badges
- Crash recovery coordination (no more restart cascade)
- User-stopped tracking survives reboots
- Tiered boot recovery (databases → core → services → apps)

UI:
- Wallet TransactionsModal, health-aware app status badges
- Restart button on containers, exited/crashed red state
- Mesh view overhaul, glass button updates, BaseModal/ToggleSwitch
- Apps sticky header removed, dev faucet, mutable mock wallet

Infrastructure:
- LND REST port 8080 exposed over Tor (LND Connect fix)
- Nginx cookie_session fix, deploy script Tor config updated
- Dev environment: podman auto-start, boot mode simulation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/locales/en.json

@@ -703,5 +703,53 @@
     "containers": "Containers",
     "goToLogin": "Go to Login",
     "lastChecked": "Last checked: {time}"
+  },
+  "receiveBitcoin": {
+    "onChain": "On-Chain",
+    "lightning": "Lightning",
+    "ecash": "Ecash",
+    "amountSats": "Amount (sats)",
+    "memoOptional": "Memo (optional)",
+    "memoPlaceholder": "Payment for...",
+    "invoiceShareLabel": "Invoice (share with sender):",
+    "yourBitcoinAddress": "Your Bitcoin address:",
+    "pasteEcashToken": "Paste ecash token",
+    "processing": "Processing...",
+    "generateAddress": "Generate Address",
+    "createInvoice": "Create Invoice",
+    "receive": "Receive",
+    "enterAnAmount": "Enter an amount",
+    "pasteAnEcashToken": "Paste an ecash token",
+    "tokenReceivedSuccess": "Token received successfully!"
+  },
+  "sendBitcoin": {
+    "onChain": "On-chain",
+    "auto": "Auto",
+    "lightning": "Lightning",
+    "ecash": "Ecash",
+    "autoMethodDesc": "Auto-selects method based on amount: ecash < 1k sats, Lightning 1k\u2013500k, on-chain > 500k",
+    "amountSats": "Amount (sats)",
+    "lightningInvoice": "Lightning Invoice (BOLT11)",
+    "bitcoinAddress": "Bitcoin Address",
+    "tokenShareLabel": "Token (share with recipient):",
+    "sentTx": "Sent! TX: {txid}",
+    "paidHash": "Paid! Hash: {hash}"
+  },
+  "transactions": {
+    "title": "Transactions",
+    "noTransactionsYet": "No transactions yet",
+    "unconfirmed": "Unconfirmed",
+    "confirmations": "{count} conf",
+    "justNow": "just now",
+    "minutesAgo": "{count}m ago",
+    "hoursAgo": "{count}h ago",
+    "daysAgo": "{count}d ago"
+  },
+  "easyHome": {
+    "beginner": "Beginner",
+    "intermediate": "Intermediate",
+    "done": "Done",
+    "inProgress": "In Progress",
+    "start": "Start"
   }
 }

neode-ui/src/locales/es.json

@@ -702,5 +702,53 @@
     "containers": "Contenedores",
     "goToLogin": "Ir a inicio de sesi\u00f3n",
     "lastChecked": "\u00daltima verificaci\u00f3n: {time}"
+  },
+  "receiveBitcoin": {
+    "onChain": "On-Chain",
+    "lightning": "Lightning",
+    "ecash": "Ecash",
+    "amountSats": "Monto (sats)",
+    "memoOptional": "Nota (opcional)",
+    "memoPlaceholder": "Pago por...",
+    "invoiceShareLabel": "Factura (compartir con el remitente):",
+    "yourBitcoinAddress": "Su direcci\u00f3n Bitcoin:",
+    "pasteEcashToken": "Pegar token Ecash",
+    "processing": "Procesando...",
+    "generateAddress": "Generar direcci\u00f3n",
+    "createInvoice": "Crear factura",
+    "receive": "Recibir",
+    "enterAnAmount": "Ingrese un monto",
+    "pasteAnEcashToken": "Pegue un token Ecash",
+    "tokenReceivedSuccess": "\u00a1Token recibido exitosamente!"
+  },
+  "sendBitcoin": {
+    "onChain": "On-chain",
+    "auto": "Auto",
+    "lightning": "Lightning",
+    "ecash": "Ecash",
+    "autoMethodDesc": "Selecci\u00f3n autom\u00e1tica seg\u00fan monto: ecash < 1k sats, Lightning 1k\u2013500k, on-chain > 500k",
+    "amountSats": "Monto (sats)",
+    "lightningInvoice": "Factura Lightning (BOLT11)",
+    "bitcoinAddress": "Direcci\u00f3n Bitcoin",
+    "tokenShareLabel": "Token (compartir con el destinatario):",
+    "sentTx": "\u00a1Enviado! TX: {txid}",
+    "paidHash": "\u00a1Pagado! Hash: {hash}"
+  },
+  "transactions": {
+    "title": "Transacciones",
+    "noTransactionsYet": "A\u00fan no hay transacciones",
+    "unconfirmed": "Sin confirmar",
+    "confirmations": "{count} conf",
+    "justNow": "justo ahora",
+    "minutesAgo": "hace {count}m",
+    "hoursAgo": "hace {count}h",
+    "daysAgo": "hace {count}d"
+  },
+  "easyHome": {
+    "beginner": "Principiante",
+    "intermediate": "Intermedio",
+    "done": "Listo",
+    "inProgress": "En progreso",
+    "start": "Iniciar"
   }
 }