fix(apps): session_passthrough on companion UI ports; indeedhub-redis caps

- lnd-ui/bitcoin-ui/electrs-ui/fips-ui declare session_passthrough: true
  on their gated ports — their nginx forwards the browser's node session
  to the daemon's authenticated endpoints, which the gate's cookie strip
  was discarding (every data call 401'd behind the gate).
- indeedhub-redis gains CHOWN + DAC_OVERRIDE: the alpine entrypoint runs
  as capability-stripped container-root and could not traverse the 0700
  appendonlydir owned by the redis uid — crash-looped ~4k restarts on
  archi-dev-box under the quadlet migration.

These reach nodes via the signed catalog re-sign (manifest overlay).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/fips-ui/manifest.yml

@@ -39,6 +39,10 @@ app:
       protocol: tcp
       bind: 127.0.0.1
       auth: gated
+      # First-party companion UI: its nginx forwards the node session cookie
+      # to the daemon's authenticated endpoints; without passthrough the gate
+      # strips it and every data call 401s while the page shell renders.
+      session_passthrough: true
 
   volumes: []