fix: WebSocket reconnect state refresh, listener leak fixes, pin container images

- F4: Fetch fresh server state after WebSocket reconnect
- F5: Guard message polling timer with auth check, stop on logout
- F6: Remove NIP-07 listener in appLauncher close()
- F7: Initialize audio player once to prevent listener stacking
- S3: Pin all container images to specific versions, create image-versions.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/deploy-bitcoin-knots.sh

@@ -9,6 +9,10 @@
 
 set -e
 
+# Source pinned image versions (single source of truth)
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+[ -f "$SCRIPT_DIR/image-versions.sh" ] && . "$SCRIPT_DIR/image-versions.sh"
+
 # Read per-installation Bitcoin RPC credentials
 SECRETS_DIR="/var/lib/archipelago/secrets"
 sudo mkdir -p "$SECRETS_DIR" && sudo chmod 700 "$SECRETS_DIR"
@@ -48,7 +52,7 @@ podman run -d \
   --label "com.archipelago.icon=/assets/img/app-icons/bitcoin-knots.webp" \
   --label "com.archipelago.port=8332" \
   --label "com.archipelago.repo=https://github.com/bitcoinknots/bitcoin" \
-  docker.io/bitcoinknots/bitcoin:latest \
+  "${BITCOIN_KNOTS_IMAGE:-docker.io/bitcoinknots/bitcoin:v28.1}" \
   -server=1 \
   -txindex=1 \
   -rpcallowip=127.0.0.1/32 -rpcallowip=10.88.0.0/16 \
@@ -89,7 +93,7 @@ EOF
 cp /home/archipelago/archy/docker/bitcoin-ui/index.html "$BUILD_DIR/"
 
 # Build the image
-podman build -t localhost/bitcoin-ui:latest "$BUILD_DIR"
+podman build -t localhost/bitcoin-ui:local "$BUILD_DIR"
 
 # Deploy UI container
 podman run -d \
@@ -98,7 +102,7 @@ podman run -d \
   -p 8334:80 \
   --label "com.archipelago.app=bitcoin-ui" \
   --label "com.archipelago.parent=bitcoin-knots" \
-  localhost/bitcoin-ui:latest
+  localhost/bitcoin-ui:local
 
 echo "   ✅ Bitcoin UI deployed on port 8334"