fix(pine): serve the Connect-to-WiFi button over an http->https redirect

The launcher must be a secure context for Web Bluetooth, but the UI opens local
apps as http://host:port (resolveAppUrl), so an https-only launcher (v1.1.0)
would break the Open button with a TLS mismatch. Serve http on 10380 (the Open
target) that 301-redirects to the https listener on 10381, so the new tab lands
on https where navigator.bluetooth is available. Bump pine 1.1.0 -> 1.1.1;
re-sign the catalog (only the pine entry changes).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/pine/manifest.yml

@@ -1,7 +1,7 @@
 app:
   id: pine
   name: Pine
-  version: "1.1.0"
+  version: "1.1.1"
   description: A private voice assistant for your home. Pine runs speech-to-text (Whisper) and text-to-speech (Piper) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud.
   category: home
 
@@ -45,7 +45,14 @@ app:
     network_policy: isolated
 
   ports:
+    # 10380 (http) is the Open target — the UI launches apps as
+    # http://host:10380 (resolveAppUrl). nginx there 301-redirects to the https
+    # listener on 10381, so the new tab lands on a secure context where
+    # navigator.bluetooth (the "Connect Pine to WiFi" provisioner) works.
     - host: 10380
+      container: 80
+      protocol: tcp
+    - host: 10381
       container: 443
       protocol: tcp
 
@@ -73,6 +80,11 @@ app:
     - path: /var/lib/archipelago/pine/nginx.conf
       overwrite: true
       content: |
+        server {
+            listen 80;
+            server_name _;
+            return 301 https://$host:10381$request_uri;
+        }
         server {
             listen 443 ssl;
             server_name _;
@@ -305,7 +317,7 @@ app:
       description: Connect your speaker to WiFi and check the voice assistant
       type: ui
       port: 10380
-      protocol: https
+      protocol: http
       path: /
 
   metadata: