fix: portainer pin, bitcoin conf tolerance, gate login UI, named OTA origin

Portainer: nodes have been running :latest — which is 2.39.1 — while the
manifest pinned 2.19.4 from two years ago. The port migration recreated the
container onto that old pin and Portainer refused to start: it migrates a
database forward, never backward, so an existing install died with 'schema
version does not align' and My Apps showed 'app is not responding'
(100.82.34.38). 2.39.1 published as an immutable tag and pinned forward, so
existing databases keep working and older ones migrate up.

Bitcoin: complements PR #131. That removes the code which kept writing a
datadir bitcoin.conf; -allowignoredconf=1 additionally makes an existing
one non-fatal, so a node already carrying the file recovers on restart
instead of crash-looping until something reinstalls it.

App gate login: rebuilt against the dashboard's own design — rotating
intro backgrounds served from the gate, the glass panel, the Archipelago
mark in its gradient ring, the app's icon as a My Apps tile, and the glass
button. Crucially it no longer sends X-Frame-Options: DENY, which made
every gated app render as unreachable inside My Apps' embedded frame;
frame-ancestors expresses 'only this node may frame me', which
X-Frame-Options cannot.

OTA origin: primary mirror is now source.archipelago-foundation.org over
TLS instead of a bare IP on plaintext. The IP stays as an automatic
fallback for nodes whose DNS or clock is broken — both break TLS, and the
signature, not the transport, is what establishes trust.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/update.rs

@@ -74,7 +74,20 @@ fn is_newer(candidate: &str, current: &str) -> bool {
     }
 }
 
+/// Primary OTA origin. Named host over TLS rather than the bare IP it used
+/// to be: the IP pinned the fleet to one machine and one plaintext port, so
+/// moving or fronting the origin meant an OTA to change where OTAs come
+/// from — the one update you cannot ship if the origin is unreachable. The
+/// signature is what establishes trust (see `trust::anchor`), not the
+/// transport, but HTTPS also stops a network observer seeing which version
+/// a node runs.
 const DEFAULT_UPDATE_MANIFEST_URL: &str =
+    "https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/releases/manifest.json";
+
+/// The previous IP-based origin, kept as an automatic fallback so a node
+/// whose DNS or TLS is broken still updates. Dropped from the mirror list
+/// once the fleet has moved.
+const LEGACY_UPDATE_MANIFEST_URL: &str =
     "http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json";
 const UPDATE_STATE_FILE: &str = "update_state.json";
 const UPDATE_MIRRORS_FILE: &str = "update-mirrors.json";
@@ -113,10 +126,19 @@ fn mirrors_path(data_dir: &Path) -> std::path::PathBuf {
 }
 
 fn default_mirrors() -> Vec<UpdateMirror> {
-    vec![UpdateMirror {
-        url: DEFAULT_UPDATE_MANIFEST_URL.to_string(),
-        label: "Server 1 (OVH)".to_string(),
-    }]
+    vec![
+        UpdateMirror {
+            url: DEFAULT_UPDATE_MANIFEST_URL.to_string(),
+            label: "Archipelago Foundation".to_string(),
+        },
+        // Fallback, tried only if the named origin fails: a node whose DNS
+        // or clock is wrong (both break TLS) must still be able to update
+        // itself, and the signature check is what makes either source safe.
+        UpdateMirror {
+            url: LEGACY_UPDATE_MANIFEST_URL.to_string(),
+            label: "Direct (fallback)".to_string(),
+        },
+    ]
 }
 
 /// Load the operator-configured mirror list. Returns defaults if the
@@ -186,15 +208,18 @@ fn force_ovh_update_primary(list: &mut Vec<UpdateMirror>) {
     }
     for mirror in list.iter_mut() {
         if mirror.url == DEFAULT_UPDATE_MANIFEST_URL {
-            mirror.label = "Server 1 (OVH)".to_string();
+            mirror.label = "Archipelago Foundation".to_string();
+        } else if mirror.url == LEGACY_UPDATE_MANIFEST_URL {
+            mirror.label = "Direct (fallback)".to_string();
         }
     }
-    list.sort_by_key(|m| {
-        if m.url == DEFAULT_UPDATE_MANIFEST_URL {
-            0
-        } else {
-            1
-        }
+    // Named origin first, its IP fallback second, anything the operator
+    // added after that. Ordering matters: the list is tried in order, so a
+    // stale entry sitting first costs a timeout on every check.
+    list.sort_by_key(|m| match m.url.as_str() {
+        u if u == DEFAULT_UPDATE_MANIFEST_URL => 0,
+        u if u == LEGACY_UPDATE_MANIFEST_URL => 1,
+        _ => 2,
     });
 }
 
@@ -2373,8 +2398,16 @@ mod tests {
     async fn test_load_mirrors_returns_defaults_when_absent() {
         let dir = tempfile::tempdir().unwrap();
         let list = load_mirrors(dir.path()).await.unwrap();
-        assert_eq!(list.len(), 1);
-        assert!(list[0].url.contains("146.59.87.168"));
+        // The named origin leads, its IP fallback follows. A node with broken
+        // DNS or a wrong clock (both break TLS) must still have a way to
+        // update; the signature is what makes either source trustworthy.
+        assert_eq!(list.len(), 2);
+        assert!(
+            list[0].url.starts_with("https://source.archipelago-foundation.org/"),
+            "the named origin must be primary, got {}",
+            list[0].url
+        );
+        assert!(list[1].url.contains("146.59.87.168"));
         assert!(
             !list.iter().any(|m| m.url.contains("git.tx1138.com")),
             "tx1138 was retired as a release server and must not be a default mirror"