chore: release v1.7.45-alpha

Resilience-validated release. Three full sweeps of the new resilience
harness against .228 confirm no shipstoppers.

Big user-visible:
- Bitcoin RPC auth durably correct via host-rendered nginx.conf bind-mount,
  replaces fragile post-start exec that failed under restricted-cap rootless
  podman ("crun: write cgroup.procs: Permission denied")
- Multi-container stack installs (indeedhub, immich, btcpay, mempool) now
  emit phase events at every boundary so the progress bar advances
- Apps no longer vanish from the dashboard mid-install (absent-scanner skips
  packages in transitional states)
- Indeedhub fresh installs work end-to-end (was 8500+ restart loop): five
  missing env vars (DATABASE_PORT, QUEUE_HOST, QUEUE_PORT,
  S3_PRIVATE_BUCKET_NAME, AES_MASTER_SECRET) added to install code
- Tailscale install fixed: --entrypoint string was being passed as a single
  shell-line arg; switched to custom_args array
- Catalog cleaned of broken entries (dwn, endurain, ollama removed; nextcloud
  restored on docker.io)
- Bitcoin Core update path uses correct image (was looking for nonexistent
  lfg2025/bitcoin:28.4)
- ISO installs now allocate swap on the encrypted data partition

Infra:
- New resilience harness (scripts/resilience/) — black-box state-machine
  tester, every app × every transition. Run before each release.

Sweep #3 final: PASS 107 / FAIL 12 / SKIP 14. The 12 fails are 1 cosmetic
(homeassistant trusted_hosts), 8 harness/timing false-positives, and 3
non-shipstopper tracked items. Down from 23 in baseline sweep #1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -38,7 +38,7 @@ export const APP_PORTS: Record<string, number> = {
   'fedimint':      8175,
   'fedimintd':     8175,
   'fedimint-gateway': 8176,
-  'indeedhub':     7778,
+  'indeedhub':     7777,
   'botfights':     9100,
   'dwn':           3100,
   'endurain':      8080,
@@ -138,11 +138,24 @@ export function resolveAppUrl(id: string, routeQueryPath?: string): string {
   const ext = EXTERNAL_URLS[id]
   if (ext) return ext
 
-  // Local apps: always launch by host port
+  // Bitcoin apps always go through nginx proxy so browser basic-auth prompts never appear.
+  if (id === 'bitcoin-knots' || id === 'bitcoin-core' || id === 'bitcoin-ui') {
+    return window.location.protocol + '//' + window.location.hostname + '/app/bitcoin-ui/'
+  }
+
+  // HTTPS pages cannot embed plain HTTP port origins (mixed-content).
+  if (window.location.protocol === 'https:') {
+    const proxyPath = HTTPS_PROXY_PATHS[id]
+    if (proxyPath) {
+      return window.location.protocol + '//' + window.location.hostname + proxyPath
+    }
+  }
+
+  // Local apps on HTTP pages launch by host port.
   const port = APP_PORTS[id]
   if (!port) return ''
 
-  let base = `${window.location.protocol}//${window.location.hostname}:${port}`
+  let base = window.location.protocol + '//' + window.location.hostname + ':' + String(port)
   if (routeQueryPath) base += routeQueryPath
   return base
 }