fix(server+quadlet): app UIs work over the mesh — v6 relay + v4-pinned publishes

Rootless podman's wildcard publish claims [::] but BLACK-HOLES inbound
v6 (accepts, forwards nothing — vaultwarden 'empty response' from the
phone, 2026-07-26), while most apps got no v6 listener at all. Two
halves: quadlets now publish unbound ports on 0.0.0.0 explicitly
(frees the v6 side; the one-time drift/recreate at upgrade is the
deploy vehicle), and the daemon runs a self-selecting V6ONLY relay on
every catalog launch port forwarding raw TCP to the v4 loopback
listener. Rescans every 60s so new installs bridge without a restart.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/server.rs

@@ -1027,6 +1027,15 @@ impl Server {
 
         // Peer listener: late-binding so we don't need an archipelago
         // restart when fips0 comes up after onboarding.
+        // App UIs over the mesh: rootless podman's port forwarder binds
+        // IPv4 only for most apps, so a phone dialing [ULA]:8123 got
+        // nothing even with the firewall open (HA/FileBrowser/Gitea/
+        // Portainer/Pine all v4-only on 2026-07-26; a few bind [::]
+        // themselves). Bridge each catalog launch port to its v4 loopback
+        // listener with a V6ONLY relay — self-selecting: where the app
+        // already answers on v6 the bind fails and the app wins.
+        let relay_task = tokio::spawn(app_port_v6_relay_loop(tx.subscribe()));
+
         let peer_task = tokio::spawn(peer_late_bind_loop(
             self.api_handler.clone(),
             active_connections.clone(),
@@ -1052,6 +1061,7 @@ impl Server {
         if let Some(t) = v6_task {
             let _ = t.await;
         }
+        relay_task.abort();
         let _ = peer_task.await;
 
         info!("Shutdown complete");
@@ -1077,6 +1087,60 @@ fn bind_v6_only(addr: SocketAddr) -> std::io::Result<tokio::net::TcpListener> {
     tokio::net::TcpListener::from_std(socket.into())
 }
 
+/// IPv6→IPv4 relay for catalog app launch ports (see the spawn site for
+/// why). Rescans every 60s so ports of freshly installed apps get bridged
+/// without a daemon restart. Each relay is a V6ONLY listener forwarding
+/// raw TCP to the same port on IPv4 loopback.
+async fn app_port_v6_relay_loop(mut shutdown_rx: tokio::sync::watch::Receiver<bool>) {
+    use std::collections::HashSet;
+    let mut bridged: HashSet<u16> = HashSet::new();
+    let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
+    interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+    loop {
+        tokio::select! {
+            _ = interval.tick() => {
+                for &port in crate::fips::app_ports::APP_LAUNCH_PORTS {
+                    if bridged.contains(&port) {
+                        continue;
+                    }
+                    let addr = SocketAddr::new(
+                        std::net::IpAddr::V6(std::net::Ipv6Addr::UNSPECIFIED),
+                        port,
+                    );
+                    // EADDRINUSE = the app itself (or a prior relay) already
+                    // answers on v6 — exactly when we must stay out of the way.
+                    let Ok(listener) = bind_v6_only(addr) else { continue };
+                    bridged.insert(port);
+                    debug!("v6 relay bridging [::]:{port} -> 127.0.0.1:{port}");
+                    let mut rx = shutdown_rx.clone();
+                    tokio::spawn(async move {
+                        loop {
+                            tokio::select! {
+                                accepted = listener.accept() => {
+                                    let Ok((mut inbound, _)) = accepted else { break };
+                                    tokio::spawn(async move {
+                                        let Ok(mut outbound) = tokio::net::TcpStream::connect(
+                                            ("127.0.0.1", port),
+                                        )
+                                        .await else { return };
+                                        let _ = tokio::io::copy_bidirectional(
+                                            &mut inbound,
+                                            &mut outbound,
+                                        )
+                                        .await;
+                                    });
+                                }
+                                _ = rx.changed() => break,
+                            }
+                        }
+                    });
+                }
+            }
+            _ = shutdown_rx.changed() => return,
+        }
+    }
+}
+
 /// Poll every 30s for `fips0`'s ULA; when it appears, bind the peer
 /// listener and run the normal accept loop. If the bind fails (port
 /// already taken, permissions), log and keep retrying. Returns on