fix: add health RPC handler, Nostr connect timeouts, atomic backup restore, nginx rate limits

- R1: Add health RPC endpoint with crash recovery status, uptime, and version
- R2: Wrap all 5 Nostr client.connect() calls in 10s timeout
- R3: Make backup restore atomic with staging dir and rollback on failure
- I1: Add rate limiting, body size, and proxy timeouts to unauthenticated nginx endpoints

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/crash_recovery.rs

@@ -13,6 +13,7 @@ use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
+use std::time::Instant;
 use tokio::fs;
 use tracing::{info, warn};
 
@@ -23,6 +24,22 @@ const USER_STOPPED_FILE: &str = "user-stopped.json";
 /// Shared flag: true once boot recovery is complete. Health monitor should wait for this.
 pub static RECOVERY_COMPLETE: AtomicBool = AtomicBool::new(false);
 
+/// Process start time for uptime calculation.
+static START_TIME: std::sync::OnceLock<Instant> = std::sync::OnceLock::new();
+
+/// Initialize the start time. Call once at startup.
+pub fn init_start_time() {
+    START_TIME.get_or_init(Instant::now);
+}
+
+/// Get uptime in seconds since process start.
+pub fn uptime_seconds() -> u64 {
+    START_TIME
+        .get()
+        .map(|t| t.elapsed().as_secs())
+        .unwrap_or(0)
+}
+
 /// Mark boot recovery as complete. Call after crash recovery + start_stopped_containers finish.
 pub fn mark_recovery_complete() {
     RECOVERY_COMPLETE.store(true, Ordering::SeqCst);