security+feat: v1.3.0 — pentest remediation, container reliability, UI overhaul

Security (33 pentest findings addressed):
- CRITICAL: backend binds 127.0.0.1, path traversal in tor.rs/dwn fixed
- HIGH: federation requires signatures, XSS login redirect, RBAC viewer restricted
- HIGH: tar slip prevention, S3 SSRF validation, backup ID validation
- MEDIUM: remember-me random secret, TOTP session rotation, password re-auth
- LOW: CSP unsafe-inline removed, CORS dev-only, onion/webhook validation

Container reliability:
- Memory limits on all 37 containers (OOM prevention)
- Exited vs stopped state distinction with health-aware status badges
- Crash recovery coordination (no more restart cascade)
- User-stopped tracking survives reboots
- Tiered boot recovery (databases → core → services → apps)

UI:
- Wallet TransactionsModal, health-aware app status badges
- Restart button on containers, exited/crashed red state
- Mesh view overhaul, glass button updates, BaseModal/ToggleSwitch
- Apps sticky header removed, dev faucet, mutable mock wallet

Infrastructure:
- LND REST port 8080 exposed over Tor (LND Connect fix)
- Nginx cookie_session fix, deploy script Tor config updated
- Dev environment: podman auto-start, boot mode simulation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/components/PWAUpdatePrompt.vue

@@ -1,59 +1,33 @@
 <template>
-  <Teleport to="body">
-    <Transition name="modal">
-      <div
-        v-if="showUpdatePrompt"
-        class="fixed inset-0 z-[9999] flex items-center justify-center p-4"
-        @click.self="dismissUpdate"
-      >
-        <div class="absolute inset-0 bg-black/60 backdrop-blur-sm"></div>
-        <div
-          ref="modalRef"
-          class="glass-card p-6 max-w-md w-full relative z-10"
-          @click.stop
-        >
-          <div class="flex items-start justify-between gap-4 mb-4">
-            <h3 class="text-xl font-semibold text-white">Update Available</h3>
-            <button
-              @click="dismissUpdate"
-              class="p-2 rounded-lg hover:bg-white/10 text-white/70 hover:text-white transition-colors"
-              aria-label="Dismiss"
-            >
-              <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
-              </svg>
-            </button>
-          </div>
+  <BaseModal :show="showUpdatePrompt" title="Update Available" z-index="z-[9999]" @close="dismissUpdate">
           <p class="text-white/80 mb-6">
             A new version of Archipelago is available. Update now to get the latest features and fixes.
           </p>
-          <div class="flex gap-3 justify-end">
-            <button
-              @click="dismissUpdate"
-              class="px-4 py-2 glass-button rounded-lg text-sm font-medium"
-            >
-              Later
-            </button>
-            <button
-              @click="handleUpdate"
-              class="px-4 py-2 glass-button glass-button-sm rounded-lg text-sm font-medium"
-            >
-              Update Now
-            </button>
-          </div>
-        </div>
-      </div>
-    </Transition>
-  </Teleport>
+          <template #footer>
+            <div class="flex gap-3 justify-end">
+              <button
+                @click="dismissUpdate"
+                class="px-4 py-2 glass-button rounded-lg text-sm font-medium"
+              >
+                Later
+              </button>
+              <button
+                @click="handleUpdate"
+                class="px-4 py-2 glass-button glass-button-sm rounded-lg text-sm font-medium"
+              >
+                Update Now
+              </button>
+            </div>
+          </template>
+  </BaseModal>
 </template>
 
 <script setup lang="ts">
 import { ref, onMounted } from 'vue'
-import { useModalKeyboard } from '@/composables/useModalKeyboard'
+import BaseModal from '@/components/BaseModal.vue'
 
 const showUpdatePrompt = ref(false)
 let updateCallback: (() => Promise<void>) | null = null
-const modalRef = ref<HTMLElement | null>(null)
 
 onMounted(() => {
   // Listen for service worker updates
@@ -106,8 +80,6 @@ onMounted(() => {
   }
 })
 
-useModalKeyboard(modalRef, showUpdatePrompt, dismissUpdate)
-
 function dismissUpdate() {
   showUpdatePrompt.value = false
 }