merge: bring the open-source readiness work onto the phase-13 branch

Merges gitea-ai/main (65 commits) into the phase-13 branch (419) so one
build carries both lines — the AIUI/assistant/container work and the
open-source readiness work (licensing, the marketplace DID signature layer,
the registry domain migration, the secrets and infrastructure scrub).

Every Rust file auto-merged. The container fixes from this branch and main's
registry-domain migration and node-name genericisation coexist without
manual intervention.

Conflict resolution — all of them were modify/delete, and all were resolved
in main's favour deliberately:

`.planning/**`, `scripts/deploy-to-target.sh` and `scripts/setup-aiui-server.sh`
were deleted by main's `6ba05996` ("security: remove all infrastructure and
internal process material from the repo") and added to .gitignore there.
Keeping this branch's copies would have re-committed internal process and
infrastructure material into a repo being prepared for publication, silently
undoing that cleanup. Resolved with `git rm --cached`, so every file remains
on disk locally and in this branch's history — it is untracked, not lost.
The remaining .planning files this branch added after the merge base were
untracked the same way, so the result is consistent rather than half-tracked.

Container suite 221/221 on the merged tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/middleware.rs

@@ -87,7 +87,7 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         "Insufficient funds",
         // On-chain send/sweep refusals from LND ("Failed to send: your
         // on-chain balance is too small or still unconfirmed to sweep…").
-        // Masking sent the operator to journalctl again (framework-pt
+        // Masking sent the operator to journalctl again (a test node
         // sweep, 2026-08-06) — same lesson as the two above.
         "Failed to send",
         // A frontend newer than the daemon calls methods it doesn't have.
@@ -207,7 +207,7 @@ mod sanitize_tests {
     fn lightning_payment_errors_pass_through() {
         // LND's payment-failure reasons are written for the payer — masking
         // "invoice expired" as "Check server logs" left a user retrying a
-        // dead invoice (framework-pt, 2026-07-23).
+        // dead invoice (a test node, 2026-07-23).
         for msg in [
             "Payment failed: this invoice has expired (Valid until 2026-07-23 07:41:42 +0000 UTC). Ask the recipient for a fresh invoice and try again.",
             "Payment failed: unable to find a path to destination",
@@ -323,10 +323,10 @@ mod client_ip_tests {
     #[test]
     fn loopback_connection_trusts_forwarded_header() {
         // nginx on loopback forwards the real client IP — use it.
-        let parts = parts_with(Some("127.0.0.1:44412"), Some("192.168.1.50"));
+        let parts = parts_with(Some("127.0.0.1:44412"), Some("192.0.2.50"));
         assert_eq!(
             extract_client_ip(&parts),
-            "192.168.1.50".parse::<IpAddr>().unwrap()
+            "192.0.2.50".parse::<IpAddr>().unwrap()
         );
     }