feat(apps): package podsteadr as a full Archipelago app (3-container manifest set)

Adds apps/podsteadr (main Fastify+Vue app, container.build from the podsteadr
repo), apps/podsteadr-mediamtx (RTMP/WHIP ingest, HLS, recording), and
apps/podsteadr-blossom (BUD-02 media blobs), wired together on a dedicated
podsteadr-net bridge network per the multi-container pattern documented in
docs/app-developer-guide.md (indeedhub's api/relay/minio/redis/postgres
siblings). All podsteadr ports are auth: none with a rationale, since it's a
public podcast/livestream server whose RSS feeds, HLS playback, and blob
reads must stay reachable by third-party clients with no Archipelago session
— the app already gates its own sensitive routes with NIP-98 and per-stream
secret keys.

Also updates apps/PORTS.md, apps/README.md, and bumps the reviewed
unauthenticated-port count in core/container/src/manifest.rs's
unauthenticated_ports_are_all_accounted_for test (25 -> 31) to acknowledge
the six new auth:none ports. Regenerated catalog-derived files
(core/archipelago/src/fips/app_ports.rs,
neode-ui/src/views/appSession/generatedAppSessionConfig.ts) via
scripts/generate-app-catalog.py.

All three manifests pass scripts/validate-app-manifest.sh and
`cargo test -p archipelago-container manifest`.

core/archipelago/src/fips/app_ports.rs

@@ -6,7 +6,41 @@
 //! no listener, so allowing them is inert.
 
 pub const APP_LAUNCH_PORTS: &[u16] = &[
-    2283, 2342, 3000, 3001, 3002, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087, 8088,
-    8089, 8090, 8096, 8123, 8175, 8176, 8240, 8334, 8336, 8888, 8999, 9000, 9100, 10380, 11434,
-    18081, 18083, 23000, 32838, 50002,
+    2283,
+    2342,
+    3000,
+    3001,
+    3002,
+    4080,
+    5180,
+    7778,
+    8080,
+    8081,
+    8082,
+    8083,
+    8084,
+    8085,
+    8087,
+    8088,
+    8089,
+    8090,
+    8095,
+    8096,
+    8123,
+    8175,
+    8176,
+    8240,
+    8334,
+    8336,
+    8888,
+    8999,
+    9000,
+    9100,
+    10380,
+    11434,
+    18081,
+    18083,
+    23000,
+    32838,
+    50002,
 ];

core/container/src/manifest.rs

@@ -1717,17 +1717,25 @@ app:
             }
         }
         exempt.sort();
-        // 25 as of the v1.7.123 port-policy round: bitcoin p2p (8333 ×2),
-        // core-lightning 9736/9835, electrumx 50001, fedimint 8173/8174,
-        // fedimint-gateway 8176/9737, gitea ssh 2222, lightning-stack
-        // 8091/9738/10010, lnd 9735/10009/18080, netbird 3478/8086/8087,
-        // pine TLS 10381 + the three voice ports (10200/10300/10400 — the
-        // disclosed known gap), router SSDP/mDNS 1900/5353. Every one is a
-        // deliberate, rationale-carrying exemption; the release-gate test
-        // stage timed out that cycle, so the count here lagged at 17.
+        // 31 as of the podsteadr app-package round: the prior 25 (bitcoin p2p
+        // (8333 ×2), core-lightning 9736/9835, electrumx 50001, fedimint
+        // 8173/8174, fedimint-gateway 8176/9737, gitea ssh 2222,
+        // lightning-stack 8091/9738/10010, lnd 9735/10009/18080, netbird
+        // 3478/8086/8087, pine TLS 10381 + the three voice ports
+        // (10200/10300/10400 — the disclosed known gap), router SSDP/mDNS
+        // 1900/5353) plus 6 new ones: podsteadr 8095 (web UI/API/RSS —
+        // third-party podcast clients and other podsteadr instances must
+        // fetch feeds/marketplace data with no node session; the app gates
+        // its own sensitive routes with NIP-98), podsteadr-blossom 8098
+        // (public blob reads for RSS enclosures; uploads are BUD-02
+        // signed-auth gated by blossom itself), podsteadr-mediamtx
+        // 1935/8189/8889/8890 (RTMP/ICE/WHIP ingest + HLS playback — none of
+        // these are HTTP-session-shaped, and publish is protocol-gated by a
+        // per-stream secret checked via podsteadr's own auth webhook). Every
+        // one is a deliberate, rationale-carrying exemption.
         assert_eq!(
             exempt.len(),
-            25,
+            31,
             "unauthenticated port set changed — review before updating this count: {exempt:?}"
         );
     }