docs+fix: ship fips0 web-UI firewall allowance from core; changelog + What's New for v1.7.115-alpha

fips::config::install() now writes /etc/fips/fips.d/80-web-ui.nft
(tcp 80/8443 accept) and reloads the baseline on every install/upgrade —
the hardening firewall default-denies inbound on fips0 and the UI was
unreachable over the mesh without it (root-caused live 2026-07-26).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/fips/config.rs

@@ -233,6 +233,42 @@ pub async fn install(identity_dir: &Path) -> Result<()> {
     let _ = tokio::fs::remove_file(&stage).await;
     install_result?;
 
+    // The release-hardening firewall (/etc/fips/fips.nft, provisioned
+    // out-of-band) default-denies inbound on fips0 — without an explicit
+    // allowance the node's web UI is unreachable over the mesh (phones got
+    // RST on :80 with a healthy session; root-caused 2026-07-26 on
+    // framework-pt). Ship the allowance as a fips.d drop-in on every
+    // install/upgrade so no node ever regresses to a UI-less mesh.
+    sudo_install_dir("/etc/fips/fips.d").await?;
+    let dropin = "# Written by archipelago on every daemon config install.\n\
+                  # Allows the web UI + peer API through the fips0\n\
+                  # default-deny inbound baseline (fips.nft).\n\
+                  tcp dport 80 accept\n\
+                  tcp dport 8443 accept\n";
+    let nft_stage = std::env::temp_dir().join(format!("fips-webui-{}.nft", std::process::id()));
+    tokio::fs::write(&nft_stage, dropin)
+        .await
+        .context("Failed to stage web-ui nft drop-in")?;
+    let nft_install = sudo_install_file(&nft_stage, "/etc/fips/fips.d/80-web-ui.nft", "0644").await;
+    let _ = tokio::fs::remove_file(&nft_stage).await;
+    nft_install?;
+    // Make the allowance live immediately; a no-op error when the
+    // hardening baseline isn't installed on this node yet.
+    if tokio::fs::try_exists("/etc/fips/fips.nft").await.unwrap_or(false) {
+        match Command::new("sudo")
+            .args(["nft", "-f", "/etc/fips/fips.nft"])
+            .output()
+            .await
+        {
+            Ok(out) if !out.status.success() => tracing::warn!(
+                "nft reload after web-ui drop-in failed: {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            ),
+            Err(e) => tracing::warn!("nft reload after web-ui drop-in failed: {e}"),
+            _ => {}
+        }
+    }
+
     sudo_install_file(&src_key, DAEMON_KEY_PATH, "0600").await?;
     // Heal a legacy fips_key.pub that was written as bech32 npub text
     // (pre-fix identity::write_fips_key_from_seed did this). Upstream