feat: Phase 4 backend hardening — container reliability + security audit

Container Management (CONT-01 through CONT-06):
- Fix needs_archy_net: add lnd, nbxplorer to archy-net list
- Add StartupTier dependency ordering to health monitor (DB→Core→Dependent→App→UI)
- Add exponential backoff (10s/30s/90s) with 1hr stability reset
- Add get_health_check_args() with health checks for 20+ apps
- Add get_memory_limit() with per-app limits (128m-4g vs blanket 2g)
- Create docs/network-topology.md
- Fix fedimint containers on both nodes (moved to archy-net)

Security Audit (SEC-01 through SEC-06):
- Add sanitize_error_message() — strips internal paths from RPC errors
- Add validate_identity_id() — blocks path traversal on identity operations
- Add validate_did() — blocks path traversal on federation operations
- Add message size limits: node-send-message (1MB), dwn.write-message (10MB)
- Add rate limits for federation endpoints (join: 5/60s, invite: 10/300s)
- Configure journald (500MB max, 7 day retention) on both nodes
- Add /etc/logrotate.d/archipelago for backend + crowdsec logs
- Verify all 4 nginx security headers on both nodes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/peers.rs

@@ -1,5 +1,5 @@
 use super::RpcHandler;
-use crate::{node_message, nostr_discovery, peers};
+use crate::{federation, node_message, nostr_discovery, peers};
 use crate::peers::KnownPeer;
 use anyhow::Result;
 
@@ -61,15 +61,29 @@ impl RpcHandler {
             .and_then(|v| v.as_str())
             .ok_or_else(|| anyhow::anyhow!("Missing message"))?;
 
-        // Validate onion is a known peer to prevent SSRF to arbitrary Tor destinations
+        // Limit message size to 1MB to prevent DoS
+        if message.len() > 1_048_576 {
+            anyhow::bail!("Message too large (max 1MB)");
+        }
+
+        // Validate onion is a known peer or federated node to prevent SSRF
         let known_peers = peers::load_peers(&self.config.data_dir).await?;
-        let is_known = known_peers.iter().any(|p| {
+        let is_known_peer = known_peers.iter().any(|p| {
             p.onion == onion || p.onion == format!("{}.onion", onion)
                 || format!("{}.onion", p.onion) == onion
         });
-        if !is_known {
+        let is_known_fed = if !is_known_peer {
+            let fed_nodes = federation::load_nodes(&self.config.data_dir).await.unwrap_or_default();
+            fed_nodes.iter().any(|n| {
+                n.onion == onion || n.onion == format!("{}.onion", onion)
+                    || format!("{}.onion", n.onion) == onion
+            })
+        } else {
+            false
+        };
+        if !is_known_peer && !is_known_fed {
             return Err(anyhow::anyhow!(
-                "Onion address not in known peers list. Add the peer first."
+                "Onion address not in known peers or federation. Add the peer first."
             ));
         }