fix(appgate+container): stop stripping app cookies; create named volumes correctly

Two daemon bugs, one debugging arc (2026-08-05, operator-reported):

1. The app gate removed the ENTIRE Cookie header before proxying. That
   broke the data plane of every first-party companion UI behind the gate
   (lnd-ui/bitcoin-ui/electrs-ui/fips-ui render their shell, then every
   /proxy/* and /lnd-connect-info call 401s — observed as "LND UI
   unreachable"), and silently logged users out of every gated app with
   its own cookie login (vaultwarden, nextcloud, gitea) on each request.
   The gate now strips only its own cookie pairs (session, csrf_token);
   a new per-port manifest opt-in `session_passthrough: true` forwards
   the node session to first-party UIs whose nginx proxies the daemon's
   authenticated endpoints. Undeclared ports never get passthrough.

2. podman_client::create_container sent named volumes to the libpod API
   as bind mounts with the bare volume name as source, so creating any
   manifest app with a `type: volume` mount failed. On .38 the reconciler
   removed indeedhub-postgres/-minio for env drift and then could never
   create their replacements, leaving the stack half-missing forever.
   Named volumes now ride the spec's `volumes` field ({Name, Dest,
   Options}). Also: the reconcile-failure log now prints the full anyhow
   chain — `%e` showed only "create_container X" and hid the real error.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/appgate/identity.rs

@@ -35,6 +35,11 @@ pub struct GatedPort {
     /// Tor-upstream bind — must key on this flag: acting on an undeclared
     /// port is the v1.7.121 incident class, whatever the action.
     pub declared: bool,
+    /// Manifest opt-in (`session_passthrough: true` on the port): forward the
+    /// node session cookie to the app on authorised requests. First-party
+    /// companion UIs proxy that cookie to the daemon's authenticated
+    /// endpoints; for every other app the gate strips its own credential.
+    pub session_passthrough: bool,
 }
 
 /// A port deliberately left unauthenticated, and the manifest's stated reason.
@@ -226,6 +231,7 @@ fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
                         app_name: app_name.clone(),
                         icon: icon.clone(),
                         declared: true,
+                        session_passthrough: port.session_passthrough,
                     },
                 );
             }
@@ -273,6 +279,9 @@ fn classify_manifest(manifest: &AppManifest, map: &mut PortMap) {
                         app_name: app_name.clone(),
                         icon: icon.clone(),
                         declared: false,
+                        // An undeclared port never gets the node session —
+                        // passthrough is an explicit manifest opt-in only.
+                        session_passthrough: false,
                     },
                 );
             }