feat(apps): complete the manifest platform — convert the last five stragglers

Nginx Proxy Manager, Tailscale, Ollama, CryptPad, and AdGuard Home now
carry full manifests: the app gate fronts their web ports (TLS on the
same port, node login where appropriate), installs run through the
orchestrator, and pins live in the signed catalog. Tailscale mirrors its
legacy shape exactly (userspace networking, web console on 8240, plain
HTTP for the gate to front). Ollama stays loopback-only — the
assistant's local model backend, not a web app.

Retires the four already-removed apps for good (FIPS, Nostr VPN,
Routstr, Penpot pins dropped from image-versions.sh, the generator map,
and image_versions.rs), fixes Cuprate's duplicated metadata block that
strict YAML parsers reject, and updates the port-inventory review gates
for the new open (3 own-login consoles) and exempt (2 DNS) ports.

core/archipelago/src/container/image_versions.rs

@@ -178,18 +178,10 @@ fn image_var_for_app(app_id: &str) -> Option<&'static str> {
 
         // Nostr / VPN
         "nostr-rs-relay" => Some("NOSTR_RS_RELAY_IMAGE"),
-        "nostr-vpn" => Some("NOSTR_VPN_IMAGE"),
-        "fips" => Some("FIPS_IMAGE"),
 
         // Immich (primary = server)
         "immich" | "immich_server" => Some("IMMICH_SERVER_IMAGE"),
 
-        // Penpot (primary = frontend)
-        "penpot" | "penpot-frontend" => Some("PENPOT_FRONTEND_IMAGE"),
-
-        // AI
-        "routstr" => Some("ROUTSTR_IMAGE"),
-
         // Networking
         "adguardhome" => Some("ADGUARDHOME_IMAGE"),
         "tor" | "archy-tor" => Some("ALPINE_TOR_IMAGE"),
@@ -341,13 +333,6 @@ pub fn containers_for_stack(app_id: &str) -> Vec<(&'static str, &'static str)> {
             ("immich_redis", "REDIS_IMAGE"),
             ("immich_server", "IMMICH_SERVER_IMAGE"),
         ],
-        "penpot" | "penpot-frontend" => vec![
-            ("penpot-postgres", "PENPOT_POSTGRES_IMAGE"),
-            ("penpot-valkey", "PENPOT_VALKEY_IMAGE"),
-            ("penpot-backend", "PENPOT_BACKEND_IMAGE"),
-            ("penpot-exporter", "PENPOT_EXPORTER_IMAGE"),
-            ("penpot-frontend", "PENPOT_FRONTEND_IMAGE"),
-        ],
         "netbird" => vec![
             ("netbird", "NETBIRD_PROXY_IMAGE"),
             ("netbird-dashboard", "NETBIRD_DASHBOARD_IMAGE"),

core/container/src/manifest.rs

@@ -1746,6 +1746,11 @@ app:
             }
         }
         exempt.sort();
+        // 30 as of 2026-08-31: the 28 below plus adguardhome's two DNS ports
+        // (53 udp + tcp) — plain DNS answers unauthenticated by protocol, the
+        // same reason router's mDNS/SSDP and every p2p port is exempt; each
+        // carries its auth_rationale in the manifest.
+        //
         // 28 as of 2026-08-23: the 26 below plus cuprate's two exemptions —
         // 18183 (Monero p2p gossip, same reasoning as bitcoin's 8333) and
         // 18090 (host mapping for Monero's canonical 18089 restricted RPC,
@@ -1771,7 +1776,7 @@ app:
         // stage timed out that cycle, so the count here lagged at 17.
         assert_eq!(
             exempt.len(),
-            28,
+            30,
             "unauthenticated port set changed — review before updating this count: {exempt:?}"
         );
     }
@@ -1801,15 +1806,22 @@ app:
             }
         }
         open.sort();
-        // Gitea 3001 (git clients speak basic-auth, not browser cookies) and
+        // Gitea 3001 (git clients speak basic-auth, not browser cookies),
         // BTCPay 23000 (checkout/invoice/webhook endpoints must be reachable
-        // by anonymous payers). Both enforce their own account login, and an
-        // operator can re-gate either from Settings → Access control.
+        // by anonymous payers), and — since the v1.8.7 platform round — the
+        // three own-login consoles brought onto the manifest platform:
+        // nginx-proxy-manager 8081 (NPM admin accounts), tailscale 8240
+        // (tailnet login on the web console), adguardhome 3000 (AGH admin
+        // accounts + first-run wizard). All enforce their own login, and an
+        // operator can re-gate any of them from Settings → Access control.
         assert_eq!(
             open,
             vec![
+                ("adguardhome".to_string(), 3000u16),
                 ("btcpay-server".to_string(), 23000u16),
-                ("gitea".to_string(), 3001u16)
+                ("gitea".to_string(), 3001u16),
+                ("nginx-proxy-manager".to_string(), 8081u16),
+                ("tailscale".to_string(), 8240u16),
             ],
             "gate-open port set changed — every entry must be an app with its own login"
         );