fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps

- lnd-ui/bitcoin-ui/electrs-ui/fips-ui declare session_passthrough: true
  on their gated ports — their nginx forwards the browser's node session
  to the daemon's authenticated endpoints, which the gate's cookie strip
  was discarding (every data call 401'd behind the gate).
- indeedhub-redis gains CHOWN + DAC_OVERRIDE: the alpine entrypoint runs
  as capability-stripped container-root and could not traverse the 0700
  appendonlydir owned by the redis uid — crash-looped ~4k restarts on
  archi-dev-box under the quadlet migration.

These reach nodes via the signed catalog re-sign (manifest overlay).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/bitcoin-ui/manifest.yml

@@ -43,6 +43,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes:
     # Bind-mount the rendered nginx.conf read-only. The prod orchestrator

apps/electrs-ui/manifest.yml

@@ -35,6 +35,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 

apps/fips-ui/manifest.yml

@@ -39,6 +39,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []
 

apps/indeedhub-redis/manifest.yml

@@ -22,7 +22,13 @@ app:
     memory_limit: 256Mi
 
   security:
-    capabilities: [SETGID, SETUID]
+    # The alpine entrypoint runs as container-root, `find`s /data to chown
+    # anything not owned by the redis user, then su-execs to it. Under the
+    # orchestrator's --cap-drop=ALL, root cannot traverse the 0700
+    # appendonlydir owned by uid 999 without DAC_OVERRIDE (observed
+    # crash-looping ~4k restarts on archi-dev-box) — CHOWN is what the find's
+    # -exec chown needs on adopted legacy data.
+    capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID]
     readonly_root: false
     network_policy: isolated
 

apps/lnd-ui/manifest.yml

@@ -47,6 +47,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []