fix(ui): gate-fronted https launches + signed-catalog App Store

directAppUrl(), the legacy open() path, and resolveRuntimeLaunchUrl()
now upgrade to https only for ports the app gate fronts — decided from
the signed catalog's embedded manifest ports (auth gated/open), so
plain-HTTP publishes (legacy installs, auth:none API ports like
Cuprate's RPC) keep http instead of failing outright. fetchAppCatalog()
merges the daemon-verified signed catalog into the App Store listing
(signed entries appear immediately; community copy supplies featured
and curated metadata), and Marketplace.vue uses the same dynamic fetcher
as Discover so the grid sees signed-new apps too.

neode-ui/src/stores/__tests__/appLauncher.test.ts

@@ -1,5 +1,17 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { setActivePinia, createPinia } from 'pinia'
+import { __setSignedCatalogForTests } from '@/views/discover/curatedApps'
+
+// The signed catalog's embedded manifests decide which ports the app gate
+// fronts (TLS on the same port) — prime the same shape the live catalog
+// carries for the apps these tests launch.
+const SIGNED = {
+  apps: {
+    vaultwarden: { version: '1.37.1', manifest: { app: { ports: [{ host: 8082, auth: 'gated' }] } } },
+    gitea: { version: '1.23', manifest: { app: { ports: [{ host: 3001, auth: 'open' }] } } },
+    'nginx-proxy-manager': { version: 'latest' }, // legacy: no manifest → http
+  },
+}
 
 // vi.hoisted runs before vi.mock hoisting
 const { mockPush, mockWindowOpen } = vi.hoisted(() => ({
@@ -23,6 +35,7 @@ describe('useAppLauncherStore', () => {
   beforeEach(() => {
     setActivePinia(createPinia())
     vi.clearAllMocks()
+    __setSignedCatalogForTests(SIGNED as never)
     // Default to HTTP to avoid proxy rewriting
     Object.defineProperty(window, 'location', {
       value: { origin: 'http://192.0.2.10', protocol: 'http:', hostname: '192.0.2.10' },