feat: complete Phase 1 foundation hardening + three-mode UI design doc

Phase 1a — Gradient Removal:
- Replaced all gradient-button/gradient-card with glass-button/path-option-card
- Removed banned gradient CSS classes

Phase 1b — Security Hardening:
- SecretsManager: AES-256-GCM encryption (core/security)
- electrs_status: credentials from env vars instead of hardcoded
- port_manager: RwLock proper error handling (no unwrap)
- Pinned all 11 :latest manifest images to specific versions
- parmanode converter: pinned inferred image versions

Phase 1c — Code Quality:
- Split rpc.rs (1795 lines) into 6 handler modules (auth, node, container, package, peers)
- Removed sideload code (UI, store, RPC client, 3 doc files)
- Fixed body background flash on logout/refresh
- Replaced 30 TypeScript `any` types with proper types
- Deleted HelloWorld.vue, removed TODO comments
- Added set -euo pipefail to all shell scripts
- Made deploy script verbose with timestamps and elapsed time

Also adds:
- CLAUDE.md project guide
- docs/three-mode-ui-design.md — design spec for Easy/Pro/Chat UI modes
- OnlineStatusPill component

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/did-wallet/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Web5 wallet with Decentralized Identifier (DID) support. Manage your digital identity and Web5 assets.
   
   container:
-    image: archipelago/did-wallet:latest
+    image: archipelago/did-wallet:1.0.0
     image_signature: cosign://...
     pull_policy: if-not-present
     

apps/endurain/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Endurain application platform. Custom application runtime.
   
   container:
-    image: archipelago/endurain:latest
+    image: archipelago/endurain:1.0.0
     image_signature: cosign://...
     pull_policy: if-not-present
     

apps/indeedhub/manifest.yml

@@ -6,7 +6,7 @@ app:
   category: media
   
   container:
-    image: localhost/indeedhub:latest
+    image: localhost/indeedhub:1.0.0
     pull_policy: never  # Built locally
     
   dependencies:

apps/meshtastic/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Open-source mesh networking for LoRa radios. Create decentralized communication networks.
   
   container:
-    image: meshtastic/meshtastic:latest
+    image: meshtastic/meshtasticd:2.5.6
     image_signature: cosign://...
     pull_policy: verify-signature
     

apps/morphos-server/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: MorphOS server platform. Decentralized application server.
   
   container:
-    image: archipelago/morphos-server:latest
+    image: archipelago/morphos-server:1.0.0
     image_signature: cosign://...
     pull_policy: if-not-present
     

apps/nostr-rs-relay/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: High-performance Nostr relay written in Rust. Host your own decentralized social media relay and earn networking profits.
   
   container:
-    image: scsibug/nostr-rs-relay:latest
+    image: scsibug/nostr-rs-relay:0.8.9
     image_signature: cosign://...
     pull_policy: verify-signature
     

apps/ollama/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Run large language models locally. Privacy-preserving AI on your node.
   
   container:
-    image: ollama/ollama:latest
+    image: ollama/ollama:0.6.2
     image_signature: cosign://...
     pull_policy: if-not-present
     

apps/penpot/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Open-source design and prototyping platform. Design tools for teams.
   
   container:
-    image: penpot/penpot:latest
+    image: penpotapp/frontend:2.13.3
     image_signature: cosign://...
     pull_policy: if-not-present
     

apps/router/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Mesh routing and local network management. Provides device discovery, routing, and network topology visualization.
   
   container:
-    image: archipelago/router:latest
+    image: archipelago/router:1.0.0
     image_signature: cosign://...
     pull_policy: if-not-present
     

apps/strfry/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Lightweight Nostr relay written in C++. Alternative to nostr-rs-relay with lower resource usage.
   
   container:
-    image: strfry/strfry:latest
+    image: dockurr/strfry:1.0.4
     image_signature: cosign://...
     pull_policy: verify-signature
     

apps/web5-dwn/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Personal data store for Web5. Store and sync your decentralized data across devices.
   
   container:
-    image: archipelago/web5-dwn:latest
+    image: archipelago/web5-dwn:1.0.0
     image_signature: cosign://...
     pull_policy: if-not-present