fix(botfights): 1.2.2 — allow node-dashboard iframe embedding via ARCHY_EMBEDDED=1

1.2.x's auth-hardening work added Hono secureHeaders() with a default
X-Frame-Options: SAMEORIGIN, which unconditionally blocked the Archipelago
node dashboard's iframe (different origin by port) — a real regression
versus 1.1.0, which never sent this header. Fixed upstream in the botfight
repo (commit 8eb27ed): X-Frame-Options is now conditional on ARCHY_EMBEDDED,
disabled only for the first-party node-embedded instance.

apps/botfights/manifest.yml: image/version -> 1.2.2, adds
ARCHY_EMBEDDED=1 to environment, drops the interim
metadata.launch.open_in_new_tab workaround (no longer needed — the app can
now be framed). app-catalog/catalog.json, scripts/image-versions.sh,
neode-ui/public/catalog.json bumped in lockstep via
scripts/generate-app-catalog.py. core/archipelago/src/fips/app_ports.rs
regenerated (formatting only, same port set).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/botfights/manifest.yml

@@ -1,12 +1,12 @@
 app:
   id: botfights
   name: BotFights
-  version: 1.2.1
+  version: 1.2.2
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.2.1
+    image: 146.59.87.168:3000/lfg2025/botfights:1.2.2
     pull_policy: always
     # Auto-generated on first install (random hex, 0600, rootless-owned). The
     # 1.2.x image's server/src/middleware/jwt.ts throws at module import when
@@ -60,6 +60,11 @@ app:
     # without this var set), and an operator can remove this line entirely to
     # run a fully standalone, node-local arena instead.
     - ARENA_UPSTREAM_URL=https://botfights.archipelago-foundation.org
+    # Tells the app it is embedded (first-party) in the node dashboard's
+    # iframe, so it can safely disable X-Frame-Options: SAMEORIGIN — see
+    # server/src/app.ts in the botfight repo. Without this the 1.2.x image's
+    # default security headers block the dashboard iframe entirely.
+    - ARCHY_EMBEDDED=1
 
   health_check:
     type: http