fix: harden OTA updates, AIUI desktop gap, LND no-proxy

- update.rs: post-OTA probe falls back to http://127.0.0.1/ on connect
  error (nginx binds :80, not :443) so good updates are no longer rolled
  back; recover stuck update_in_progress; avoid ETXTBSY on running binary
- LND: REST client bypasses proxy, GET newaddress p2wkh, wallet
  readiness/unlock after restart
- Dashboard.vue: chat route back to plain h-full (desktop bottom-gap fix)
- vite.config.ts: dev-only /aiui proxy
- tests/release/run.sh: release gate harness (static+frontend+backend)
- CHANGELOG: v1.7.89-alpha notes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/archipelago/src/container/lnd.rs

@@ -76,7 +76,7 @@ pub async fn ensure_wallet_initialized() -> Result<()> {
     let admin_macaroon = "/var/lib/archipelago/lnd/data/chain/bitcoin/mainnet/admin.macaroon";
     let wallet_db = "/var/lib/archipelago/lnd/data/chain/bitcoin/mainnet/wallet.db";
     if file_exists_as_root(wallet_db).await {
-        if file_exists_as_root(admin_macaroon).await {
+        if file_exists_as_root(admin_macaroon).await && lnd_getinfo_ready(admin_macaroon).await {
             return Ok(());
         }
         unlock_existing_wallet().await?;
@@ -127,6 +127,7 @@ async fn unlock_existing_wallet() -> Result<()> {
 
 async fn unlock_existing_wallet_via_rest() -> Result<()> {
     let client = reqwest::Client::builder()
+        .no_proxy()
         .timeout(std::time::Duration::from_secs(20))
         .danger_accept_invalid_certs(true)
         .build()
@@ -204,6 +205,7 @@ struct InitWalletRequest {
 
 async fn init_wallet_via_rest() -> Result<()> {
     let client = reqwest::Client::builder()
+        .no_proxy()
         .timeout(std::time::Duration::from_secs(20))
         .danger_accept_invalid_certs(true)
         .build()
@@ -305,12 +307,12 @@ async fn decode_lnd_unlocker_response<T: for<'de> Deserialize<'de>>(
     anyhow::bail!("LND REST {path} returned {status}: {text}")
 }
 
-#[allow(dead_code)]
 async fn lnd_getinfo_ready(admin_macaroon: &str) -> bool {
     let Ok(macaroon) = read_file_as_root(admin_macaroon).await else {
         return false;
     };
     let Ok(client) = reqwest::Client::builder()
+        .no_proxy()
         .timeout(std::time::Duration::from_secs(5))
         .danger_accept_invalid_certs(true)
         .build()

core/archipelago/src/container/prod_orchestrator.rs

@@ -3220,11 +3220,11 @@ app:
       - /data/.filebrowser.json
   volumes:
     - type: bind
-      source: /tmp/filebrowser-srv
+      source: /var/lib/archipelago/filebrowser-srv
       target: /srv
       options: [rw]
     - type: bind
-      source: /tmp/filebrowser-data
+      source: /var/lib/archipelago/filebrowser-data
       target: /data
       options: [rw]
 "#;
@@ -3244,7 +3244,7 @@ app:
         secret_file: bitcoin-rpc-password
   volumes:
     - type: bind
-      source: /tmp/lnd
+      source: /var/lib/archipelago/lnd
       target: /root/.lnd
 "#;
         AppManifest::parse(yaml).unwrap()