feat: migrate all container images to Archipelago app registry

All container image references now pull from 80.71.235.15:3000/archipelago/
instead of Docker Hub and ghcr.io. image-versions.sh is the single source
of truth; all scripts use $*_IMAGE variables instead of hardcoded refs.

Files updated:
- scripts/image-versions.sh: central ARCHY_REGISTRY variable
- core/*/config.rs: registry whitelist includes app registry
- core/*/stacks.rs: Immich + Penpot stack images
- scripts/{first-boot,deploy-to-target,container-specs}.sh: use variables
- docker/*/Dockerfile: nginx base image from registry
- image-recipe/: ISO build, podman config, menu script
- scripts/{container-doctor,deploy-bitcoin-knots,fix-indeedhub,validate-app-manifest}.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/fix-indeedhub-containers.sh

@@ -28,7 +28,7 @@ fi
 
 # Verify correct images are available
 echo "Verifying images..."
-for img in "${INDEEDHUB_REDIS_IMAGE:-docker.io/library/redis:7-alpine}" "${MINIO_IMAGE:-docker.io/minio/minio:RELEASE.2024-11-07T00-52-20Z}" "${INDEEDHUB_POSTGRES_IMAGE:-docker.io/library/postgres:16-alpine}" "${NOSTR_RS_RELAY_IMAGE:-docker.io/scsibug/nostr-rs-relay:0.9.0}" "${SEARXNG_IMAGE:-docker.io/searxng/searxng:2024.11.17}" "localhost/indeedhub:local" "localhost/indeedhub-build_api:local" "localhost/indeedhub-build_ffmpeg-worker:local"; do
+for img in "${INDEEDHUB_REDIS_IMAGE}" "${MINIO_IMAGE}" "${INDEEDHUB_POSTGRES_IMAGE}" "${NOSTR_RS_RELAY_IMAGE}" "${SEARXNG_IMAGE}" "localhost/indeedhub:local" "localhost/indeedhub-build_api:local" "localhost/indeedhub-build_ffmpeg-worker:local"; do
   if ! podman image exists "$img" 2>/dev/null; then
     echo "ERROR: Missing image $img"
     exit 1
@@ -63,7 +63,7 @@ podman run -d --name indeedhub-postgres \
   -e POSTGRES_USER=indeedhub \
   -e POSTGRES_PASSWORD=indeehhub-archy-2026 \
   -e POSTGRES_DB=indeedhub \
-  docker.io/library/postgres:16-alpine
+  "$INDEEDHUB_POSTGRES_IMAGE"
 
 # Wait for postgres to be ready
 echo "Waiting for postgres..."
@@ -81,7 +81,7 @@ podman run -d --name indeedhub-redis \
   --restart unless-stopped \
   --network "$NETWORK" --network-alias redis \
   -v indeedhub-redis-data:/data \
-  docker.io/library/redis:7-alpine \
+  "$INDEEDHUB_REDIS_IMAGE" \
   redis-server --appendonly yes
 
 # 3. MinIO
@@ -92,7 +92,7 @@ podman run -d --name indeedhub-minio \
   -v indeedhub-minio-data:/data \
   -e MINIO_ROOT_USER=indeeadmin \
   -e MINIO_ROOT_PASSWORD=indeeadmin2026 \
-  "${MINIO_IMAGE:-docker.io/minio/minio:RELEASE.2024-11-07T00-52-20Z}" \
+  "${MINIO_IMAGE}" \
   server /data --console-address ":9001"
 
 # 4. Nostr Relay
@@ -101,7 +101,7 @@ podman run -d --name indeedhub-relay \
   --restart unless-stopped \
   --network "$NETWORK" --network-alias relay \
   -v indeedhub-relay-data:/usr/src/app/db \
-  "${NOSTR_RS_RELAY_IMAGE:-docker.io/scsibug/nostr-rs-relay:0.9.0}"
+  "${NOSTR_RS_RELAY_IMAGE}"
 
 # 5. API
 echo "Creating api..."
@@ -227,7 +227,7 @@ echo "Creating searxng..."
 podman run -d --name searxng \
   --restart unless-stopped \
   -p 8888:8080 \
-  "${SEARXNG_IMAGE:-docker.io/searxng/searxng:2024.11.17}"
+  "${SEARXNG_IMAGE}"
 
 echo ""
 echo "=== Verifying container status ==="