feat(apps): package podsteadr as a full Archipelago app (3-container manifest set)

Adds apps/podsteadr (main Fastify+Vue app, container.build from the podsteadr
repo), apps/podsteadr-mediamtx (RTMP/WHIP ingest, HLS, recording), and
apps/podsteadr-blossom (BUD-02 media blobs), wired together on a dedicated
podsteadr-net bridge network per the multi-container pattern documented in
docs/app-developer-guide.md (indeedhub's api/relay/minio/redis/postgres
siblings). All podsteadr ports are auth: none with a rationale, since it's a
public podcast/livestream server whose RSS feeds, HLS playback, and blob
reads must stay reachable by third-party clients with no Archipelago session
— the app already gates its own sensitive routes with NIP-98 and per-stream
secret keys.

Also updates apps/PORTS.md, apps/README.md, and bumps the reviewed
unauthenticated-port count in core/container/src/manifest.rs's
unauthenticated_ports_are_all_accounted_for test (25 -> 31) to acknowledge
the six new auth:none ports. Regenerated catalog-derived files
(core/archipelago/src/fips/app_ports.rs,
neode-ui/src/views/appSession/generatedAppSessionConfig.ts) via
scripts/generate-app-catalog.py.

All three manifests pass scripts/validate-app-manifest.sh and
`cargo test -p archipelago-container manifest`.

core/container/src/manifest.rs

@@ -1717,17 +1717,25 @@ app:
             }
         }
         exempt.sort();
-        // 25 as of the v1.7.123 port-policy round: bitcoin p2p (8333 ×2),
-        // core-lightning 9736/9835, electrumx 50001, fedimint 8173/8174,
-        // fedimint-gateway 8176/9737, gitea ssh 2222, lightning-stack
-        // 8091/9738/10010, lnd 9735/10009/18080, netbird 3478/8086/8087,
-        // pine TLS 10381 + the three voice ports (10200/10300/10400 — the
-        // disclosed known gap), router SSDP/mDNS 1900/5353. Every one is a
-        // deliberate, rationale-carrying exemption; the release-gate test
-        // stage timed out that cycle, so the count here lagged at 17.
+        // 31 as of the podsteadr app-package round: the prior 25 (bitcoin p2p
+        // (8333 ×2), core-lightning 9736/9835, electrumx 50001, fedimint
+        // 8173/8174, fedimint-gateway 8176/9737, gitea ssh 2222,
+        // lightning-stack 8091/9738/10010, lnd 9735/10009/18080, netbird
+        // 3478/8086/8087, pine TLS 10381 + the three voice ports
+        // (10200/10300/10400 — the disclosed known gap), router SSDP/mDNS
+        // 1900/5353) plus 6 new ones: podsteadr 8095 (web UI/API/RSS —
+        // third-party podcast clients and other podsteadr instances must
+        // fetch feeds/marketplace data with no node session; the app gates
+        // its own sensitive routes with NIP-98), podsteadr-blossom 8098
+        // (public blob reads for RSS enclosures; uploads are BUD-02
+        // signed-auth gated by blossom itself), podsteadr-mediamtx
+        // 1935/8189/8889/8890 (RTMP/ICE/WHIP ingest + HLS playback — none of
+        // these are HTTP-session-shaped, and publish is protocol-gated by a
+        // per-stream secret checked via podsteadr's own auth webhook). Every
+        // one is a deliberate, rationale-carrying exemption.
         assert_eq!(
             exempt.len(),
-            25,
+            31,
             "unauthenticated port set changed — review before updating this count: {exempt:?}"
         );
     }