feat(cuprate-ui): companion dashboard for the Cuprate Monero node

Same companion shape as bitcoin-ui/electrs-ui: host-networked nginx
bound to 127.0.0.1:18091 (auth: gated + session_passthrough), serving
a dark glass status page that polls the node's restricted RPC via a
session-gated /cuprate-rpc/ proxy — sync height/target with progress
bar, peers, mempool, chain size and free disk (from get_info), plus a
wallet 'remote node' endpoint. The offline state explains the disk gate
so a refused node says why.

No secret rendering: the restricted RPC is Monero's safe-for-public
subset, so nginx.conf is baked into the image (no pre_start hook, no
bind mount). companion.rs auto-provisions archy-cuprate-ui alongside
cuprate and reaps it when cuprate goes.

Catalog regenerated (cuprate-ui entry + manifest embed, 18091 into the
mesh launch-port list). NOTE: releases/app-catalog.json is UNSIGNED as
committed — run scripts/sign-catalog.sh before publishing.

scripts/check-app-catalog-drift.py

@@ -19,6 +19,7 @@ INTERNAL_MANIFEST_IDS = {
     "archy-nbxplorer",
     "bitcoin-ui",
     "core-lightning",
+    "cuprate-ui",
     "electrs-ui",
     "fips-ui",
     "lnd-ui",

scripts/generate-app-catalog.sh

@@ -65,6 +65,7 @@ SINGLE = {
     "bitcoin-ui": "BITCOIN_UI_IMAGE",
     "lnd-ui": "LND_UI_IMAGE",
     "electrs-ui": "ELECTRS_UI_IMAGE",
+    "cuprate-ui": "CUPRATE_UI_IMAGE",
     "homeassistant": "HOMEASSISTANT_IMAGE",
     "grafana": "GRAFANA_IMAGE",
     "uptime-kuma": "UPTIME_KUMA_IMAGE",

scripts/image-versions.sh

@@ -126,6 +126,7 @@ IMMICH_SERVER_IMAGE="$ARCHY_REGISTRY/immich-server:release"
 BITCOIN_UI_IMAGE="$ARCHY_REGISTRY/bitcoin-ui:1.7.123-alpha"
 LND_UI_IMAGE="$ARCHY_REGISTRY/lnd-ui:1.7.123-alpha"
 ELECTRS_UI_IMAGE="$ARCHY_REGISTRY/electrs-ui:1.7.123-alpha"
+CUPRATE_UI_IMAGE="$ARCHY_REGISTRY/cuprate-ui:1.7.123-alpha"
 
 # Base images
 NGINX_ALPINE_IMAGE="$ARCHY_REGISTRY/nginx:1.27.4-alpine"