fix(server): web UI listens on IPv6 — the mesh could never load it

The mesh is IPv6-only; the main web listener bound 0.0.0.0 only, so a
phone reaching a node over its fips0 ULA got RST on :80
(ERR_CONNECTION_ABORTED) — UI over mesh was structurally impossible.
Confirmed 2026-07-26 on framework-pt: v4:80 = 200, v6:80 = refused.
Mirror an IPv4-any main listener with a V6ONLY [::] socket on the same
port; V6ONLY so it coexists with the v4 listener regardless of
net.ipv6.bindv6only.

Also: fips.yaml generator carries the fast-reconnect profile (validated
live on framework-pt since 2026-07-24; snapshot tests updated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/server.rs

@@ -988,6 +988,43 @@ impl Server {
             main_addr,
         ));
 
+        // The mesh is IPv6-only: a phone reaching the node over its fips0
+        // ULA lands on port 80 over v6, where a 0.0.0.0 listener never
+        // answers — the UI was structurally unreachable over the mesh
+        // (RST -> ERR_CONNECTION_ABORTED, confirmed 2026-07-26: v4:80 = 200,
+        // v6:80 = refused). Mirror an IPv4-any main listener with a
+        // V6ONLY [::] socket on the same port — v6-only so it coexists
+        // with the v4 listener regardless of net.ipv6.bindv6only.
+        let v4_any_port = match main_addr {
+            SocketAddr::V4(v4) if v4.ip().is_unspecified() => Some(v4.port()),
+            _ => None,
+        };
+        let v6_task = if let Some(port) = v4_any_port {
+            let v6_addr = SocketAddr::new(
+                std::net::IpAddr::V6(std::net::Ipv6Addr::UNSPECIFIED),
+                port,
+            );
+            match bind_v6_only(v6_addr) {
+                Ok(listener) => {
+                    info!("IPv6 web listener bound {} (mesh ULA reachable)", v6_addr);
+                    Some(tokio::spawn(accept_loop(
+                        self.api_handler.clone(),
+                        listener,
+                        active_connections.clone(),
+                        false, // same semantics as the main listener
+                        tx.subscribe(),
+                        v6_addr,
+                    )))
+                }
+                Err(e) => {
+                    warn!("IPv6 web listener bind {} failed: {} — UI stays v4-only", v6_addr, e);
+                    None
+                }
+            }
+        } else {
+            None
+        };
+
         // Peer listener: late-binding so we don't need an archipelago
         // restart when fips0 comes up after onboarding.
         let peer_task = tokio::spawn(peer_late_bind_loop(
@@ -1012,6 +1049,9 @@ impl Server {
         }
 
         let _ = main_task.await;
+        if let Some(t) = v6_task {
+            let _ = t.await;
+        }
         let _ = peer_task.await;
 
         info!("Shutdown complete");
@@ -1019,6 +1059,24 @@ impl Server {
     }
 }
 
+/// Bind a V6ONLY `[::]` TCP listener. V6ONLY is set explicitly so the
+/// socket never claims the IPv4 side (which the main listener owns) —
+/// without it, Linux hosts with `net.ipv6.bindv6only=0` would fail with
+/// EADDRINUSE.
+fn bind_v6_only(addr: SocketAddr) -> std::io::Result<tokio::net::TcpListener> {
+    let socket = socket2::Socket::new(
+        socket2::Domain::IPV6,
+        socket2::Type::STREAM,
+        Some(socket2::Protocol::TCP),
+    )?;
+    socket.set_only_v6(true)?;
+    socket.set_reuse_address(true)?;
+    socket.set_nonblocking(true)?;
+    socket.bind(&addr.into())?;
+    socket.listen(1024)?;
+    tokio::net::TcpListener::from_std(socket.into())
+}
+
 /// Poll every 30s for `fips0`'s ULA; when it appears, bind the peer
 /// listener and run the normal accept loop. If the bind fails (port
 /// already taken, permissions), log and keep retrying. Returns on