feat: Phase 4 backend hardening — container reliability + security audit

Container Management (CONT-01 through CONT-06):
- Fix needs_archy_net: add lnd, nbxplorer to archy-net list
- Add StartupTier dependency ordering to health monitor (DB→Core→Dependent→App→UI)
- Add exponential backoff (10s/30s/90s) with 1hr stability reset
- Add get_health_check_args() with health checks for 20+ apps
- Add get_memory_limit() with per-app limits (128m-4g vs blanket 2g)
- Create docs/network-topology.md
- Fix fedimint containers on both nodes (moved to archy-net)

Security Audit (SEC-01 through SEC-06):
- Add sanitize_error_message() — strips internal paths from RPC errors
- Add validate_identity_id() — blocks path traversal on identity operations
- Add validate_did() — blocks path traversal on federation operations
- Add message size limits: node-send-message (1MB), dwn.write-message (10MB)
- Add rate limits for federation endpoints (join: 5/60s, invite: 10/300s)
- Configure journald (500MB max, 7 day retention) on both nodes
- Add /etc/logrotate.d/archipelago for backend + crowdsec logs
- Verify all 4 nginx security headers on both nodes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/session.rs

@@ -312,6 +312,13 @@ impl EndpointRateLimiter {
         limits.insert("system.shutdown".to_string(), (2, 300));
         // Password changes
         limits.insert("auth.changePassword".to_string(), (3, 300));
+        // Federation join: prevent invite-code brute force
+        limits.insert("federation.join".to_string(), (5, 60));
+        limits.insert("federation.invite".to_string(), (10, 300));
+        // Inter-node federation RPCs (unauthenticated, need stricter limits)
+        limits.insert("federation.peer-joined".to_string(), (10, 60));
+        limits.insert("federation.peer-address-changed".to_string(), (10, 60));
+        limits.insert("federation.get-state".to_string(), (30, 60));
 
         Self {
             requests: Arc::new(RwLock::new(HashMap::new())),