fix(apps): NPM needs /etc/letsencrypt mounted and NET_BIND_SERVICE

Converting Nginx Proxy Manager to a platform manifest (fc68c5b6) dropped
two things its image hard-requires, and the result was an endless
start/die loop — shorty-s watched it restart 3,176 times:

1. /etc/letsencrypt mount: NPM's s6 'prepare' service refuses to boot
   without it ('ERROR: /etc/letsencrypt is not mounted!'). Mounted from
   the same persistent app directory as before
   (/var/lib/archipelago/nginx-proxy-manager/letsencrypt), so existing
   certificates are preserved — no data moves, no migration.

2. NET_BIND_SERVICE: NPM's internal nginx listens on 80, 443 AND 81,
   and the orchestrator runs --cap-drop=ALL. The legacy podman-run path
   defaulted to the full capability set (and the legacy repair path in
   package/config.rs always listed it), which is why this only broke
   once the manifest became the source of truth.

The signed catalog embeds manifests with origin-wins semantics, so the
catalog carries the fix for every catalog-covered node — regenerate it
here (plus the generated store/launcher-port artifacts, which also pick
up drift from bf6ef964's retired apps). Catalog re-signing follows the
usual ceremony.

neode-ui/src/views/appSession/generatedAppSessionConfig.ts

@@ -1,6 +1,7 @@
 /** Generated by scripts/generate-app-catalog.py. Do not edit manually. */
 
 export const GENERATED_APP_PORTS: Record<string, number> = {
+  "adguardhome": 3030,
   "aiui": 5180,
   "alby-hub": 8187,
   "archy-mempool-web": 4080,
@@ -8,7 +9,6 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
   "bitcoin-ui": 8334,
   "botfights": 9100,
   "btcpay-server": 23000,
-  "did-wallet": 8088,
   "electrs-ui": 50002,
   "electrumx": 50002,
   "fedimint": 8175,
@@ -23,9 +23,9 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
   "lnd-ui": 18083,
   "mempool": 4080,
   "mempool-api": 8999,
-  "morphos-server": 8089,
   "netbird": 8087,
   "nextcloud": 8085,
+  "nginx-proxy-manager": 8081,
   "nostr-rs-relay": 18081,
   "photoprism": 2342,
   "pine": 10380,
@@ -33,11 +33,13 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
   "router": 8084,
   "searxng": 8888,
   "strfry": 8090,
+  "tailscale": 8240,
   "uptime-kuma": 3002,
   "vaultwarden": 8082,
 }
 
 export const GENERATED_APP_TITLES: Record<string, string> = {
+  "adguardhome": "AdGuard Home",
   "aiui": "AI Assistant",
   "alby-hub": "Alby Hub",
   "archy-btcpay-db": "BTCPay Postgres",
@@ -52,7 +54,6 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
   "btcpay-server": "BTCPay Server",
   "core-lightning": "Core Lightning (CLN)",
   "cuprate": "Cuprate",
-  "did-wallet": "Web5 DID Wallet",
   "electrs-ui": "Electrs UI",
   "electrumx": "ElectrumX",
   "fedimint": "Fedimint Guardian",
@@ -74,17 +75,17 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
   "indeedhub-redis": "IndeedHub Redis",
   "indeedhub-relay": "IndeedHub Nostr Relay",
   "jellyfin": "Jellyfin",
-  "lightning-stack": "Lightning Stack",
   "lnd": "LND",
   "lnd-ui": "LND UI",
   "mempool": "Mempool Explorer",
   "mempool-api": "Mempool API",
-  "morphos-server": "MorphOS Server",
   "netbird": "NetBird",
   "netbird-dashboard": "NetBird Dashboard",
   "netbird-server": "NetBird Server",
   "nextcloud": "Nextcloud",
+  "nginx-proxy-manager": "Nginx Proxy Manager",
   "nostr-rs-relay": "Nostr Relay (Rust)",
+  "ollama": "Ollama",
   "phoenixd": "phoenixd",
   "photoprism": "PhotoPrism",
   "pine": "Pine",
@@ -95,6 +96,7 @@ export const GENERATED_APP_TITLES: Record<string, string> = {
   "router": "Mesh Router",
   "searxng": "SearXNG",
   "strfry": "Strfry Nostr Relay",
+  "tailscale": "Tailscale",
   "uptime-kuma": "Uptime Kuma",
   "vaultwarden": "Vaultwarden",
 }