feat(botfights): 1.2.7 — server-side AI bot (poll mode) + Latest Bouts short-viewport fix

Bumps to botfights:1.2.7, which carries the botfight repo's new
"let BotFights answer for me" feature (ca5b634) — an operator can paste an
Anthropic or OpenAI API key so this node's BotFights server answers fight
challenges automatically for a poll-mode bot, no external script needed.
Storage/security follows the same pattern this node already uses for its
own AIUI Anthropic key (system.settings.set "claude_api_key" in
core/archipelago/src/api/rpc/system/handlers.rs): 0600 file, never echoed
back. Also carries the nostr-provider.js 404 fix, DocsPage/round-jump
fixes, and the HomePage "Latest Bouts" short-viewport visibility fix from
the prior 1.2.4-1.2.6 iterations that were built and tested locally but
not yet pushed through the signed-catalog path.

No archy-side manifest changes beyond the version/image bump — 1.2.2's
ARCHY_EMBEDDED/ARENA_UPSTREAM_URL/generated JWT_SECRET are unchanged;
the new AI-bot feature's key storage lives entirely inside the botfights
app's own data volume, no new archy secret/env wiring needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/botfights/manifest.yml

@@ -1,12 +1,12 @@
 app:
   id: botfights
   name: BotFights
-  version: 1.2.3
+  version: 1.2.7
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.2.3
+    image: 146.59.87.168:3000/lfg2025/botfights:1.2.7
     pull_policy: always
     # Auto-generated on first install (random hex, 0600, rootless-owned). The
     # 1.2.x image's server/src/middleware/jwt.ts throws at module import when