feat: architecture review fixes, self-update system, CI pipeline, supply chain hardening

Architecture review (all P0+P1 issues now fixed):
- Add 10s timeout to 6 bare Nostr client.connect() calls
- Pin all 12 crypto deps to exact versions from Cargo.lock
- Pin all 15 floating container image tags to exact patch versions
- Add CI pipeline (cargo fmt + clippy + tests, frontend type-check + build)

Self-update system (git.tx1138.com):
- scripts/self-update.sh: pull, build, install, restart with rollback
- systemd timer checks daily at 3 AM
- update.check RPC does git-based checks when repo is present
- update.git-apply RPC triggers self-update from UI
- Default update URL changed from GitHub to git.tx1138.com
- Git added to ISO package list for fresh installs

Documentation:
- CHANGELOG v1.3.1 with all changes
- README updated (version, update system section)
- BETA-PROGRESS session #6 logged
- architecture-review.html: 4 issues marked FIXED, 8/12 refactoring done

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/identity_manager.rs

@@ -7,6 +7,7 @@ use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};
 use rand::rngs::OsRng;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
+use std::time::Duration;
 use tokio::fs;
 
 use crate::identity::did_key_from_pubkey_hex;
@@ -406,7 +407,9 @@ impl IdentityManager {
 
         let client = nostr_sdk::Client::new(keys);
         client.add_relay(relay_url).await.context("Failed to add relay")?;
-        client.connect().await;
+        if tokio::time::timeout(Duration::from_secs(10), client.connect()).await.is_err() {
+            tracing::warn!("Nostr relay connection timed out after 10s, continuing anyway");
+        }
 
         let builder = nostr_sdk::prelude::EventBuilder::new(
             nostr_sdk::prelude::Kind::Metadata,