chore: Debian 12 → 13 (Trixie) migration, service hardening

- Update all references from Debian 12 (Bookworm) to Debian 13 (Trixie)
- Enable SystemCallArchitectures, RestrictAddressFamilies, RestrictRealtime
  in archipelago.service (safe on systemd 256+ which respects NoNewPrivileges=no)
- Update GLIBC compatibility checks from 2.36 to 2.40
- ISO filename, build container, and docs updated throughout

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -2,7 +2,7 @@
 
 Archipelago is a **Bitcoin Node OS** — bootable, self-sovereign personal server. Flash to USB, install on hardware, manage via web UI.
 
-**Stack**: Rust backend + Vue 3 + TypeScript (strict) + Vite 7 + Tailwind + Pinia + Podman on Debian 12
+**Stack**: Rust backend + Vue 3 + TypeScript (strict) + Vite 7 + Tailwind + Pinia + Podman on Debian 13
 **Version**: 1.3.0 | **Target**: x86_64 and ARM64
 
 ## Beta Freeze (2026-03-18)
@@ -22,7 +22,7 @@ cd neode-ui && npm run build      # Build (outputs to web/dist/neode-ui/)
 ## Architecture
 
 ```
-Debian 12
+Debian 13
   ├── Podman (rootless, user archipelago)
   ├── Nginx (80/443 → backend, app proxies)
   ├── Rust Backend (core/) on 127.0.0.1:5678