fix: WebSocket reconnect state refresh, listener leak fixes, pin container images

- F4: Fetch fresh server state after WebSocket reconnect
- F5: Guard message polling timer with auth check, stop on logout
- F6: Remove NIP-07 listener in appLauncher close()
- F7: Initialize audio player once to prevent listener stacking
- S3: Pin all container images to specific versions, create image-versions.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/stores/app.ts

@@ -149,7 +149,18 @@ export const useAppStore = defineStore('app', () => {
       
       await wsClient.connect()
       if (import.meta.env.DEV) console.log('[Store] WebSocket connected')
-      
+
+      // Fetch fresh state after reconnect to avoid stale patch application
+      try {
+        const freshState = await rpcClient.call<{ data: DataModel }>({ method: 'server.get-state' })
+        if (freshState?.data) {
+          data.value = freshState.data
+        }
+      } catch {
+        // Non-fatal: WebSocket patches will still work
+        if (import.meta.env.DEV) console.warn('[Store] Failed to fetch fresh state after reconnect')
+      }
+
       // Connection state will be updated via the callback
       if (wsClient.isConnected()) {
         isConnected.value = true

neode-ui/src/stores/appLauncher.ts

@@ -162,6 +162,9 @@ export const useAppLauncherStore = defineStore('appLauncher', () => {
     isOpen.value = false
     url.value = ''
     title.value = ''
+    // Explicitly remove NIP-07 listener as safety net — if user navigates away
+    // without close() triggering the isOpen watcher, the listener would leak
+    window.removeEventListener('message', handleNostrRequest)
     if (toRestore && typeof toRestore.focus === 'function') {
       requestAnimationFrame(() => {
         toRestore.focus()