fix(ui): https app launches and the nostr bridge follow the frame's real origin

Three launcher/bridge defects combined to make HTTPS dashboards look
broken while HTTP ones worked:

1. portAuth() looked the launch port up under the name the user clicks
   ('mempool-web', 'lnd', 'bitcoin-knots'…), but the signed catalog
   declares those ports under the manifest id that owns them
   (archy-mempool-web, lnd-ui, bitcoin-ui). The lookup missed,
   portIsGateFronted answered false, and an HTTPS dashboard handed app
   frames http:// URLs — blocked as mixed content: mempool and IndeeHub
   'did not connect', bitcoin knots/core opened http:// in a new tab.
   Resolution now follows launch aliases, then a port-wide catalog scan
   that only answers when every declarer of that port agrees (a port
   any app publishes as plain HTTP is never upgraded to https).

2. The signed-catalog cache was only warmed by the Store/Discover
   views, so a user who went straight to My Apps launched apps with an
   empty cache. Warmed at dashboard mount now — fetchAppCatalog()
   already memoizes with a 1h TTL.

3. The NIP-07 bridge compared event.origin for strict equality with the
   recorded (http) app URL and replied to the recorded URL as the
   postMessage targetOrigin — both break the moment a frame is scheme-
   upgraded (cached HSTS did exactly that): every nostr request was
   silently dropped and replies to the stale origin threw. The bridge
   now matches host+port (scheme deliberately ignored) and always
   replies to event.origin — the frame's real origin.

Unit tests cover alias resolution (incl. bitcoin-knots→8334→https),
the conservative port-scan, and scheme-agnostic sender matching.

neode-ui/src/App.vue

@@ -117,6 +117,7 @@ import { useSpotlightStore } from '@/stores/spotlight'
 import { useCLIStore } from '@/stores/cli'
 import { useMessageToast } from '@/composables/useMessageToast'
 import { useAppStore } from '@/stores/app'
+import { fetchAppCatalog } from './views/discover/curatedApps'
 import { useScreensaverStore } from '@/stores/screensaver'
 import { useUIModeStore } from '@/stores/uiMode'
 import { startRemoteRelay, stopRemoteRelay } from '@/api/remote-relay'
@@ -396,6 +397,13 @@ function onVisibilityChange() {
 
 onMounted(async () => {
   syncKioskSafeArea()
+  // Warm the signed-catalog cache before any app launch needs it: port auth
+  // (gate-fronted ⇒ TLS on the app port) decides whether an app frame opens
+  // over https on an HTTPS dashboard. The cache used to be filled only by
+  // the Store/Discover views, so a user who went straight to My Apps got an
+  // http:// frame URL — blocked as mixed content (mempool/indeehub "did not
+  // connect", 2026-09-01). fetchAppCatalog() memoizes with a 1h TTL.
+  void fetchAppCatalog()
   // Light app-wide mesh poll so a freshly plugged-in radio surfaces the
   // setup modal on any page (the Mesh view's own poll takes over there).
   useMeshStore().startGlobalDetection()