fix(fedimint): run fmcd with seccomp=unconfined so its DHT can start (#7)

fmcd crash-looped "Operation not permitted (os error 1)" on .116 (kernel
6.12.74): the default rootless seccomp profile blocks a syscall its Mainline-DHT
/ iroh transport needs, so the REST API never came up (:8178 → HTTP 000) and
federations couldn't be joined. Verified: with seccomp=unconfined fmcd boots and
answers /v2/* (HTTP 401 instead of dead). fmcd works on other nodes, so this is
kernel/seccomp-specific — but the relaxation is safe for an outbound-networking
daemon and harmless where not needed.

- new `security.seccomp_unconfined` manifest flag (SecurityPolicy);
- libpod backend sets `seccomp_profile_path: "unconfined"` (== --security-opt
  seccomp=unconfined); quadlet backend emits `SeccompProfile=unconfined`;
- enabled in apps/fedimint-clientd/manifest.yml.

NOTE: manifests live on-disk at /opt/archipelago/apps/<id>/manifest.yml, so the
node needs the updated manifest deployed + the fmcd container recreated to apply.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/fedimint-clientd/manifest.yml

@@ -42,6 +42,12 @@ app:
     # skip this whole manifest, so fmcd never ran and federations never joined.)
     # Lock down once the default federation's reachability model is finalized.
     network_policy: bridge
+    # fmcd's Mainline-DHT / iroh transport uses syscalls the default rootless
+    # seccomp profile blocks on some kernels (e.g. .116, kernel 6.12.74), where
+    # fmcd crash-loops "Operation not permitted (os error 1)" and never serves
+    # its REST API — so federations can't be joined (#7). Verified: with
+    # seccomp=unconfined fmcd boots and answers /v2/* (HTTP 401 vs dead 000).
+    seccomp_unconfined: true
 
   ports:
     # fmcd REST bound to 8080 in-container; 8080 collides with LND REST on the