feat(botfights): bump manifest to 1.2.1 — generated JWT_SECRET + default-on arena federation

apps/botfights/manifest.yml: image tag 1.1.0 -> 1.2.1, adds container.generated_secrets
(botfights-jwt-secret, kind hex32) + secret_env (JWT_SECRET) so a fresh install no longer
crash-loops on the 1.2.x image's jwt.ts import-time throw when JWT_SECRET is unset under
NODE_ENV=production (D-04/BOT-04). Adds ARENA_UPSTREAM_URL=https://botfights.archipelago-foundation.org
to turn on shared public arena federation by default (BOT-03/D-03), with an in-manifest comment
documenting the per-node opt-out (remove the line to run standalone).

app-catalog/catalog.json + scripts/image-versions.sh bumped in lockstep to keep the legacy
catalog and the image-version drift checker consistent with the manifest.

releases/app-catalog.json intentionally NOT committed in this change — it has been
regenerated locally (scripts/generate-app-catalog.sh) with the new manifest embedded, but is
unsigned. It is committed separately (09-06 Task 3) only after the release-root signing
ceremony, so no unsigned catalog state ever lands even transiently on a branch this repo's
mirrors could serve to nodes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app-catalog/catalog.json

@@ -109,12 +109,12 @@
     {
       "id": "botfights",
       "title": "BotFights",
-      "version": "1.1.0",
+      "version": "1.2.1",
       "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.",
       "icon": "/assets/img/app-icons/botfights.svg",
       "author": "BotFights",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.1.0",
+      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.1",
       "repoUrl": "https://botfights.net",
       "containerConfig": {
         "ports": [

apps/botfights/manifest.yml

@@ -1,13 +1,24 @@
 app:
   id: botfights
   name: BotFights
-  version: 1.1.0
+  version: 1.2.1
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.1.0
+    image: 146.59.87.168:3000/lfg2025/botfights:1.2.1
     pull_policy: always
+    # Auto-generated on first install (random hex, 0600, rootless-owned). The
+    # 1.2.x image's server/src/middleware/jwt.ts throws at module import when
+    # JWT_SECRET is unset and NODE_ENV=production, so a fresh install without
+    # this crash-loops immediately. hex32 (not base64, unlike netbird) because
+    # jwt.ts uses the value directly as an HMAC key with no decode step.
+    generated_secrets:
+      - name: botfights-jwt-secret
+        kind: hex32
+    secret_env:
+      - key: JWT_SECRET
+        secret_file: botfights-jwt-secret
 
   dependencies:
     - storage: 500Mi
@@ -41,6 +52,14 @@ app:
 
   environment:
     - NODE_ENV=production
+    - PORT=9100
+    # Default-on shared public arena federation (BOT-03/D-03): this node's
+    # BotFights becomes a thin client of the Foundation's well-known arena —
+    # all nodes see all fighters, fights cross nodes. This is a rendezvous,
+    # not an authority: any node can host its own arena (same image, just
+    # without this var set), and an operator can remove this line entirely to
+    # run a fully standalone, node-local arena instead.
+    - ARENA_UPSTREAM_URL=https://botfights.archipelago-foundation.org
 
   health_check:
     type: http

scripts/image-versions.sh

@@ -90,7 +90,7 @@ FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
 ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
 
 # Community / Gaming
-BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.1.0"
+BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.1"
 
 # IndeedHub stack
 INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"