fix(mesh,ui,fedimint): mesh-AI chat trigger + transport-aware reply, stop ARCHY:2 public-channel spam, AI allowlist + model dropdown, Fedimint client manifest, settings reorder, chat scroll

- mesh: stop broadcasting ARCHY:2 identity on the public channel (startup + every advert tick); receive path still parses inbound. No more public-channel spam.
- mesh assistant: trigger on !ai/!ask typed in 1:1 chat (was only the dead AssistQuery path + bare channel text); route the reply transport-aware via MeshService::send_message (Tor for federation peers, LoRa for radio) through a new AssistChatReply event consumed at the server layer — fixes replies never reaching federation askers.
- mesh assistant: per-contact !ai allowlist (allowed_contacts) bypassing trusted_only; config + RPC + is_sender_allowed.
- fedimint-clientd manifest: network_policy open -> bridge (invalid value made the loader skip the whole manifest, so fmcd never ran and federations never joined/listed).
- ui: AI panel — Claude model dropdown (Haiku/Sonnet/Opus presets) + allowlist contact picker.
- ui: Settings — App Updates + App Registry moved under Account.
- ui: mesh chat — overscroll-behavior: contain so chat scroll no longer bleeds to the contacts panel.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/mesh/assistant.rs

@@ -32,6 +32,7 @@ impl RpcHandler {
             "model": cfg.model,
             "trusted_only": cfg.trusted_only,
             "backend": cfg.backend,
+            "allowed_contacts": cfg.allowed_contacts,
             "default_model": DEFAULT_MODEL,
             "ollama_detected": ollama_detected,
             "claude_available": claude_available,
@@ -64,8 +65,18 @@ impl RpcHandler {
         } else {
             None
         };
+        // allowed_contacts: present + array => replace the allowlist (pubkey hex
+        // strings); absent => leave unchanged.
+        let allowed_contacts = params
+            .get("allowed_contacts")
+            .and_then(|v| v.as_array())
+            .map(|arr| {
+                arr.iter()
+                    .filter_map(|e| e.as_str().map(|s| s.to_string()))
+                    .collect::<Vec<String>>()
+            });
 
-        svc.configure_assistant(enabled, model, trusted_only, backend)
+        svc.configure_assistant(enabled, model, trusted_only, backend, allowed_contacts)
             .await?;
         let cfg = svc.assistant_config().await;
         Ok(serde_json::json!({
@@ -73,6 +84,7 @@ impl RpcHandler {
             "model": cfg.model,
             "trusted_only": cfg.trusted_only,
             "backend": cfg.backend,
+            "allowed_contacts": cfg.allowed_contacts,
         }))
     }