release(v1.7.14-alpha): install overlay + FIPS real fix + AIUI restore

Install UX
  SystemUpdate.vue now shows a full-screen overlay after apply: the
  BitcoinFaceAscii logo, a target-version label, an indeterminate
  progress stripe (solid orange; solid green on ready), and an
  elapsed-time readout. Polls /health every 1.5s and auto-reloads
  once the backend reports the new version. 3-min stall → "Reload
  now" button. Download UI also shows a spinner + "Finishing
  download — verifying checksum…" while the fake bar sits at 95%.

FIPS reconnect — for real this time
  New fips.reconnect RPC does stop → start → wait 20s → re-poll →
  classify. Classification buckets: connected / daemon_down /
  no_seed_key / no_outbound_udp_or_anchor_down / peers_but_no_anchor,
  each with a plain-language hint surfaced verbatim by the Reconnect
  button. The real reason nodes like .198/.253 couldn't reach the
  anchor: identity::write_fips_key_from_seed was writing fips_key.pub
  as a bech32 npub TEXT file, but upstream fips expects 32 raw
  bytes. The daemon silently authenticated with garbage. Fix:
  PublicKey::to_bytes() → raw 32 bytes, and new
  fips::config::normalize_pub_file migrates legacy files by decoding
  the npub and rewriting in place. fips.reconnect also re-installs
  the config + healed keys to /etc/fips before restarting.

AIUI preservation + restore
  apply_update was wiping /opt/archipelago/web-ui/aiui because the
  Vue build doesn't include it — every OTA lost the Claude sidebar.
  The preserve block now copies aiui/ + archipelago-companion.apk
  from the old web-ui into the staging dir before the swap, and
  prefers new-tar versions if present. To restore it on the three
  nodes that already lost it (.116/.198/.253), this release bundles
  the 85 MB aiui build into the frontend tarball. Frontend component
  size is now ~155 MB.

Download / install timeouts
  Backend download client timeout 1800s → 3600s (1 h). Larger
  tarball + slow gitea raw throughput put us above the old cap.
  Frontend update.download rpc timeout 30 min → 65 min to match.
  package.install rpc timeout 15 min → 45 min — IndeedHub pulls
  6 images and was timing out mid-install.

UI nit
  "Rollback to Previous" → "Rollback Available".

App-catalog proxy already landed in v1.7.13.

Artefacts:
  archipelago                                      725e18e6…3c525e6   40462288
  archipelago-frontend-1.7.14-alpha.tar.gz         c35284be…ff2c16   162077052 (+aiui)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/archipelago/src/update.rs

@@ -176,7 +176,12 @@ pub async fn download_update(data_dir: &Path) -> Result<DownloadProgress> {
         .context("Failed to create staging dir")?;
 
     let client = reqwest::Client::builder()
-        .timeout(std::time::Duration::from_secs(1800))
+        // 1h per component — the bundled frontend+aiui tarball sits at
+        // ~160 MB and git.tx1138.com raw serves at ~70 KB/s which puts
+        // the worst case above the old 30 min cap. A larger timeout
+        // with a tight connect_timeout keeps hung connections from
+        // swallowing the whole budget.
+        .timeout(std::time::Duration::from_secs(3600))
         .connect_timeout(std::time::Duration::from_secs(30))
         .build()
         .context("Failed to create HTTP client")?;
@@ -369,6 +374,21 @@ pub async fn apply_update(data_dir: &Path) -> Result<()> {
                 ])
                 .await;
 
+                // Preserve paths that are installed outside the Vue build
+                // (baked in by the ISO or sibling installers) and so
+                // aren't in the new tarball. Without this copy, every OTA
+                // wipes them — notably aiui/ (Claude Code sidebar) and
+                // the companion APK. `cp -a` preserves mode/ownership.
+                for preserved in ["aiui", "archipelago-companion.apk"] {
+                    let src = format!("{}/{}", web_ui, preserved);
+                    let dst = format!("{}/{}", staging_new, preserved);
+                    // Only preserve the old copy if the new tarball
+                    // doesn't already ship a fresher one.
+                    if Path::new(&src).exists() && !Path::new(&dst).exists() {
+                        let _ = host_sudo(&["cp", "-a", &src, &dst]).await;
+                    }
+                }
+
                 // Swap: mv current web-ui aside, then mv new into place.
                 if Path::new(web_ui).exists() {
                     let mv_old = host_sudo(&["mv", web_ui, &staging_old])