fix(ui): sanitize WireGuard QR SVG, guard mesh poll interval, log catalog fetch failures

Server.vue rendered the backend-generated WireGuard peer QR with raw
v-html while the analogous TOTP QR was DOMPurify-sanitized — both now
use the same svg-profile sanitizer. Mesh.vue's 5s poll interval gets
the same start-guard as the arch poll (no leak on double-mount) and is
nulled on unmount. curatedApps.ts catalog fetches no longer fail
silently: each failed source logs a console.warn, including the final
all-sources-failed fallback to the hardcoded list.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/src/views/discover/curatedApps.ts

@@ -57,7 +57,10 @@ export async function fetchAppCatalog(): Promise<AppCatalog | null> {
       // Cache in localStorage for offline fallback
       try { localStorage.setItem('archy_catalog', JSON.stringify(data)) } catch {}
       return data
-    } catch { continue }
+    } catch (e) {
+      console.warn(`[catalog] fetch failed for ${url}:`, e)
+      continue
+    }
   }
 
   // Try localStorage cache as final fallback
@@ -68,8 +71,11 @@ export async function fetchAppCatalog(): Promise<AppCatalog | null> {
       catalogFetchedAt = Date.now() - CATALOG_TTL + 5 * 60 * 1000 // re-check in 5 min
       return cachedCatalog
     }
-  } catch {}
+  } catch (e) {
+    console.warn('[catalog] localStorage fallback unreadable:', e)
+  }
 
+  console.warn('[catalog] all sources failed — using hardcoded app list')
   return null
 }