fix: container install flow, filebrowser auth, AppCard enrichment

- Fix .198-style fresh installs: systemd service ExecStartPre creates
  /run/user/1000, enable podman.socket, chmod 644 /etc/hosts
- Filebrowser: add /data volume for database (fixes read-only crash),
  secure auth with random password via backend RPC (no more admin/admin)
- AppCard: enrich installing state with marketplace metadata (icon,
  title, description, tier badge, author, version)
- Registry: btcpayserver 1.13.5 → 1.13.7, images mirrored
- ReadWritePaths: add home container paths for rootless podman

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/api/__tests__/filebrowser-client.test.ts

@@ -40,19 +40,18 @@ describe('FileBrowserClient', () => {
   })
 
   describe('login', () => {
-    it('authenticates and stores token', async () => {
-      mockFetch.mockResolvedValueOnce(jsonResponse('"jwt-token-123"'))
+    it('authenticates via backend RPC and stores token', async () => {
+      mockFetch.mockResolvedValueOnce(jsonResponse({ result: { token: 'jwt-token-123' } }))
 
-      // We need a fresh instance to test login — use the exported singleton
-      const result = await fileBrowserClient.login('admin', 'admin')
+      const result = await fileBrowserClient.login()
 
       expect(result).toBe(true)
       expect(fileBrowserClient.isAuthenticated).toBe(true)
       expect(mockFetch).toHaveBeenCalledWith(
-        expect.stringContaining('/app/filebrowser/api/login'),
+        '/rpc/v1',
         expect.objectContaining({
           method: 'POST',
-          body: JSON.stringify({ username: 'admin', password: 'admin' }),
+          body: JSON.stringify({ method: 'app.filebrowser-token' }),
         }),
       )
     })
@@ -60,7 +59,7 @@ describe('FileBrowserClient', () => {
     it('returns false on failed login', async () => {
       mockFetch.mockResolvedValueOnce(jsonResponse(null, 403))
 
-      const result = await fileBrowserClient.login('admin', 'wrong')
+      const result = await fileBrowserClient.login()
 
       expect(result).toBe(false)
     })