chore(catalog): re-sign the catalog with the new pins, and fix a stale firewall list

Regenerates both catalogs from the manifests so the 15 pin bumps become
real. The catalog overrides on-disk manifests on every node, so until
now those bumps were edited but inert.

There are two catalogs and regenerating one is not enough:
generate-app-catalog.sh writes releases/app-catalog.json (the signed one
nodes fetch), while generate-app-catalog.py writes app-catalog/catalog.json
and neode-ui/public/catalog.json (the source pair, the second baked into
the frontend app store). check-app-catalog-drift.py --release --strict
reads the *source* catalog, so regenerating only the release one left it
failing and would have aborted the ISO gate at stage 1 — after the
signing and tagging were already done. Drift is now 0.

The regeneration also rewrote fips/app_ports.rs, which had not been
regenerated since the initial open-source import. Diffing the port values
rather than the reformat: 36 -> 37, a single addition, **8187 — Alby
Hub**. Its port has never been in the FIPS firewall allow-list, and by
the same token neither has any app onboarded since that import. Nothing
else changed.

Catalog signed by the pinned release root and verified with
`ceremony verify`; registry trust floor checked before signing, both
hosts trusted by the deployed fleet.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neode-ui/src/views/appSession/generatedAppSessionConfig.ts

@@ -2,6 +2,7 @@
 
 export const GENERATED_APP_PORTS: Record<string, number> = {
   "aiui": 5180,
+  "alby-hub": 8187,
   "archy-mempool-web": 4080,
   "archy-nbxplorer": 32838,
   "bitcoin-ui": 8334,
@@ -38,6 +39,7 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
 
 export const GENERATED_APP_TITLES: Record<string, string> = {
   "aiui": "AI Assistant",
+  "alby-hub": "Alby Hub",
   "archy-btcpay-db": "BTCPay Postgres",
   "archy-mempool-db": "Mempool MariaDB",
   "archy-mempool-web": "Mempool Web",
@@ -82,6 +84,7 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
   "netbird-server": "NetBird Server",
   "nextcloud": "Nextcloud",
   "nostr-rs-relay": "Nostr Relay (Rust)",
+  "phoenixd": "phoenixd",
   "photoprism": "PhotoPrism",
   "pine": "Pine",
   "pine-openwakeword": "Pine Wake Word (openWakeWord)",