fix(demo): mock backend overhaul — real media, correct shapes, mempool.guide

- Serve committed demo/content (music/photos/documents) alongside demo/files
  drop-ins, normalizing top-level folder names; Dockerfile now COPYs it. This
  is why Cloud music failed: the real library sat in demo/content while the
  loader only read the empty demo/files.
- Drop unbacked seeded Videos; runtime WAV/SVG fallback for any seeded media
  without a real file so playback never hits 'no supported source'.
- monitoring.current/history/alerts/alert-rules/export rewritten to the exact
  MetricSnapshot shapes Monitoring.vue expects (epoch-second timestamps,
  containers with limits/block IO, rpc_latency_ms, ws_connections).
- streaming.list-services + configure-service (Networking Profits page was
  erroring with Method not found).
- server.get-state snapshot so the 30s resync / reconnect path stops erroring.
- lnd-connect-info now returns cert/macaroon base64url + grpc/rest ports (the
  lnd-ui shell only renders the wallet QR + details when they're present);
  LND REST balance endpoints for the shell's new balance cards.
- Fix broken icon paths (lnd.svg → lnd.png and 15 others) against real assets.
- containers-scanned: true so app cards never sit on 'Checking…'.
- 8 new installed demo apps with placeholder dashboard UIs (btcpay-server,
  grafana, nextcloud, jellyfin, vaultwarden, nostr-rs-relay, searxng,
  uptime-kuma) via the previously unused demoAppShell.
- WS heartbeat 45s → 20s (+ping 25s) so idle-timeout proxies in front of the
  public demo stop killing the socket (the 'always reconnecting' report).
- nginx demo proxy: mempool.space → mempool.guide (mempool.space blocks the
  proxied embed) + WebSocket upgrade passthrough; txid hydration follows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/docker/nginx-demo.conf

@@ -17,6 +17,12 @@ http {
     # Allow large uploads globally (filebrowser, etc.)
     client_max_body_size 0;
 
+    # WebSocket upgrade passthrough (mempool live data, etc.)
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
     server {
         listen 80 default_server;
         server_name _;
@@ -116,12 +122,15 @@ http {
             sub_filter 'url(/'    'url(/app/indeedhub/';
         }
 
-        # Mempool: same approach. NOTE mempool.space is a strict third-party app —
-        # its data/websocket calls may still be blocked; iframe is best-effort.
+        # Mempool: same approach. mempool.guide (not mempool.space, which blocks
+        # proxied embedding) — strip framing headers and rewrite absolute paths.
         location /app/mempool/ {
-            proxy_pass https://mempool.space/;
+            proxy_pass https://mempool.guide/;
             proxy_http_version 1.1;
-            proxy_set_header Host mempool.space;
+            proxy_set_header Host mempool.guide;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600;
             proxy_set_header Accept-Encoding "";
             proxy_ssl_server_name on;
             proxy_hide_header X-Frame-Options;