fix(fedimint): run fmcd with seccomp=unconfined so its DHT can start (#7)

fmcd crash-looped "Operation not permitted (os error 1)" on .116 (kernel
6.12.74): the default rootless seccomp profile blocks a syscall its Mainline-DHT
/ iroh transport needs, so the REST API never came up (:8178 → HTTP 000) and
federations couldn't be joined. Verified: with seccomp=unconfined fmcd boots and
answers /v2/* (HTTP 401 instead of dead). fmcd works on other nodes, so this is
kernel/seccomp-specific — but the relaxation is safe for an outbound-networking
daemon and harmless where not needed.

- new `security.seccomp_unconfined` manifest flag (SecurityPolicy);
- libpod backend sets `seccomp_profile_path: "unconfined"` (== --security-opt
  seccomp=unconfined); quadlet backend emits `SeccompProfile=unconfined`;
- enabled in apps/fedimint-clientd/manifest.yml.

NOTE: manifests live on-disk at /opt/archipelago/apps/<id>/manifest.yml, so the
node needs the updated manifest deployed + the fmcd container recreated to apply.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/archipelago/src/container/quadlet.rs

@@ -149,6 +149,9 @@ pub struct QuadletUnit {
     pub command: Vec<String>,
     pub read_only_root: bool,
     pub no_new_privileges: bool,
+    /// Render `SeccompProfile=unconfined` — for daemons whose networking needs
+    /// syscalls the default rootless seccomp profile blocks (e.g. fmcd, #7).
+    pub seccomp_unconfined: bool,
     pub cpu_quota: Option<u32>,
     pub restart_policy: RestartPolicy,
 }
@@ -252,6 +255,9 @@ impl QuadletUnit {
         if self.no_new_privileges {
             let _ = writeln!(s, "NoNewPrivileges=true");
         }
+        if self.seccomp_unconfined {
+            let _ = writeln!(s, "SeccompProfile=unconfined");
+        }
         if let Some(cpus) = self.cpu_quota {
             let _ = writeln!(s, "PodmanArgs=--cpus={cpus}");
         }
@@ -408,6 +414,7 @@ impl QuadletUnit {
             command: app.container.custom_args.clone(),
             read_only_root: app.security.readonly_root,
             no_new_privileges: app.security.no_new_privileges,
+            seccomp_unconfined: app.security.seccomp_unconfined,
             cpu_quota: app.resources.cpu_limit,
             restart_policy: RestartPolicy::OnFailure,
         }