fix: BUG-33 CPU threshold, TASK-27 tab icons, TASK-36 iframe errors

- BUG-33: CPU load alert threshold increased from 2x to 4x core count
  (8→16 on 4-core machine) to reduce false alerts during container ops
- TASK-27: Launch buttons for new-tab apps now show external link icon
  (BTCPay, Grafana, PhotoPrism, Portainer, OnlyOffice, etc.)
- TASK-36: Iframe error screen now distinguishes between X-Frame-Options
  blocked vs container not reachable, with appropriate messaging

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/views/Apps.vue

@@ -146,9 +146,10 @@
             v-if="canLaunch(pkg)"
             data-controller-launch-btn
             @click.stop="launchApp(id as string)"
-            class="flex-1 px-4 py-2 glass-button glass-button-sm rounded-lg text-sm font-medium"
+            class="flex-1 px-4 py-2 glass-button glass-button-sm rounded-lg text-sm font-medium flex items-center justify-center gap-1.5"
           >
             {{ t('common.launch') }}
+            <svg v-if="opensInTab(id as string)" class="w-3.5 h-3.5 opacity-60" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14" /></svg>
           </button>
           <button
             v-if="!isWebOnlyApp(id as string) && (pkg.state === 'stopped' || pkg.state === 'exited')"
@@ -490,6 +491,17 @@ function canLaunch(pkg: PackageDataEntry): boolean {
   return !!hasUI && canLaunchState
 }
 
+/** Apps that open in a new browser tab (X-Frame-Options blocks iframe) */
+const TAB_LAUNCH_APPS = new Set([
+  'btcpay-server', 'grafana', 'photoprism', 'homeassistant',
+  'vaultwarden', 'nextcloud', 'uptime-kuma', 'portainer',
+  'onlyoffice', 'nginx-proxy-manager',
+])
+
+function opensInTab(id: string): boolean {
+  return TAB_LAUNCH_APPS.has(id)
+}
+
 function launchApp(id: string) {
   useAppLauncherStore().openSession(id)
 }