fix: Tor management system, bug fixes, federation name sync

Major changes:
- Full Tor hidden service management via systemd path unit pattern
  (tor-helper.sh + archipelago-tor-helper.path/service) — respects
  NoNewPrivileges=yes, no sudo needed from backend
- Container doctor: prefer system Tor over container, remove archy-tor
- Deploy script: fix torrc generation (read correct services.json path),
  web apps map port 80→local port, enable both tor and tor@default
- Federation: server rename pushes name to peers via background sync
- Server name: fix root-owned file, optimistic store update
- Mesh: local echo for sent messages, sendingArch loading state
- Web5: Message button → Mesh redirect, node name lookup in messages
- PeerFiles: show DID not onion in header
- Connected Nodes: flex-1 instead of fixed max-h
- Toast notifications route to Mesh
- Deploy script: fix single-quote syntax in SSH block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/container-doctor.sh

@@ -85,45 +85,26 @@ fix_orphaned_conmon() {
     $fixed && return 0 || return 1
 }
 
-# ── Fix 3: System tor conflict ───────────────────────────────
+# ── Fix 3: Ensure system Tor is running (preferred over container) ──
 fix_system_tor_conflict() {
-    # Only relevant if we have a container tor on host network
-    local has_container_tor=false
+    # System Tor is preferred over container Tor.
+    # If archy-tor container exists, remove it and use system Tor instead.
     if podman ps -a --format '{{.Names}}' 2>/dev/null | grep -qE '^archy-tor$'; then
-        local net_mode
-        net_mode=$(podman inspect archy-tor --format '{{.HostConfig.NetworkMode}}' 2>/dev/null || true)
-        if [ "$net_mode" = "host" ]; then
-            has_container_tor=true
+        podman stop archy-tor 2>/dev/null || true
+        podman rm -f archy-tor 2>/dev/null || true
+        log "Removed archy-tor container (system Tor is preferred)"
+    fi
+
+    # Ensure system Tor is enabled and running
+    if command -v tor >/dev/null 2>&1; then
+        if ! systemctl is-active tor@default >/dev/null 2>&1; then
+            systemctl enable tor tor@default 2>/dev/null || true
+            systemctl start tor tor@default 2>/dev/null || true
+            log "Started system Tor"
+            return 0
         fi
     fi
 
-    if ! $has_container_tor; then
-        return 1
-    fi
-
-    # Check if system tor is binding port 9050
-    local system_tor_pid
-    system_tor_pid=$(ss -tlnp 2>/dev/null | grep ':9050 ' | grep -oP 'pid=\K\d+' | head -1)
-    if [ -z "$system_tor_pid" ]; then
-        return 1
-    fi
-
-    # Check if it's the system tor (not container tor)
-    local exe
-    exe=$(readlink /proc/"$system_tor_pid"/exe 2>/dev/null || true)
-    if [[ "$exe" == */tor ]] && ! grep -q "container" /proc/"$system_tor_pid"/cgroup 2>/dev/null; then
-        log "System tor (pid=$system_tor_pid) conflicts with container tor on port 9050"
-        systemctl stop tor@default 2>/dev/null || true
-        systemctl stop tor 2>/dev/null || true
-        systemctl disable tor@default 2>/dev/null || true
-        systemctl disable tor 2>/dev/null || true
-        sleep 2
-        # Restart container tor now that port is free
-        podman restart archy-tor 2>/dev/null || true
-        log "Disabled system tor, restarted container tor"
-        return 0
-    fi
-
     return 1
 }
 
@@ -147,9 +128,9 @@ fix_tor_permissions() {
         done < <(find "$base" -maxdepth 1 -name "hidden_service_*" -type d 2>/dev/null)
     done
 
-    # If we fixed permissions and tor container exists, restart it
+    # If we fixed permissions, restart system Tor to pick up the changes
     if $fixed; then
-        podman restart archy-tor 2>/dev/null || true
+        systemctl restart tor@default 2>/dev/null || true
         return 0
     fi
     return 1