feat(apps): complete the manifest platform — convert the last five stragglers

Nginx Proxy Manager, Tailscale, Ollama, CryptPad, and AdGuard Home now
carry full manifests: the app gate fronts their web ports (TLS on the
same port, node login where appropriate), installs run through the
orchestrator, and pins live in the signed catalog. Tailscale mirrors its
legacy shape exactly (userspace networking, web console on 8240, plain
HTTP for the gate to front). Ollama stays loopback-only — the
assistant's local model backend, not a web app.

Retires the four already-removed apps for good (FIPS, Nostr VPN,
Routstr, Penpot pins dropped from image-versions.sh, the generator map,
and image_versions.rs), fixes Cuprate's duplicated metadata block that
strict YAML parsers reject, and updates the port-inventory review gates
for the new open (3 own-login consoles) and exempt (2 DNS) ports.

scripts/generate-app-catalog.sh

@@ -81,9 +81,6 @@ SINGLE = {
     "fedimint": "FEDIMINT_IMAGE",
     "fedimint-gateway": "FEDIMINT_GATEWAY_IMAGE",
     "nostr-rs-relay": "NOSTR_RS_RELAY_IMAGE",
-    "nostr-vpn": "NOSTR_VPN_IMAGE",
-    "fips": "FIPS_IMAGE",
-    "routstr": "ROUTSTR_IMAGE",
     "adguardhome": "ADGUARDHOME_IMAGE",
 }
 
@@ -100,13 +97,6 @@ STACK = {
         "immich_postgres": "IMMICH_POSTGRES_IMAGE",
         "immich_redis": "REDIS_IMAGE",
     },
-    "penpot": {
-        "penpot-frontend": "PENPOT_FRONTEND_IMAGE",
-        "penpot-backend": "PENPOT_BACKEND_IMAGE",
-        "penpot-exporter": "PENPOT_EXPORTER_IMAGE",
-        "penpot-postgres": "PENPOT_POSTGRES_IMAGE",
-        "penpot-valkey": "PENPOT_VALKEY_IMAGE",
-    },
     "mempool": {
         "archy-mempool-web": "MEMPOOL_WEB_IMAGE",
         "mempool-api": "MEMPOOL_BACKEND_IMAGE",

scripts/image-versions.sh

@@ -99,13 +99,9 @@ VALKEY_IMAGE="$ARCHY_REGISTRY/valkey:8.1.6"
 # Nostr
 NOSTR_RS_RELAY_IMAGE="$ARCHY_REGISTRY/nostr-rs-relay:0.10.0"
 STRFRY_IMAGE="$ARCHY_REGISTRY/strfry:1.0.4"
-NOSTR_VPN_IMAGE="$ARCHY_REGISTRY/nostr-vpn:v0.3.7"
-NOSTR_VPN_UI_IMAGE="$ARCHY_REGISTRY/nostr-vpn-ui:latest"
-FIPS_IMAGE="$ARCHY_REGISTRY/fips:v0.1.0"
 FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:1.7.123-alpha"
 
 # AI / Routing
-ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
 
 # Community / Gaming
 BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.11"
@@ -127,12 +123,6 @@ GITEA_IMAGE="docker.io/gitea/gitea:1.23"
 IMMICH_POSTGRES_IMAGE="$ARCHY_REGISTRY/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0"
 IMMICH_SERVER_IMAGE="$ARCHY_REGISTRY/immich-server:release"
 
-# Penpot stack
-PENPOT_POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15"
-PENPOT_VALKEY_IMAGE="$ARCHY_REGISTRY/valkey:8.1"
-PENPOT_BACKEND_IMAGE="$ARCHY_REGISTRY/penpot-backend:2.4"
-PENPOT_EXPORTER_IMAGE="$ARCHY_REGISTRY/penpot-exporter:2.4"
-PENPOT_FRONTEND_IMAGE="$ARCHY_REGISTRY/penpot-frontend:2.4"
 
 # Custom UI containers (built from docker/ dirs, pushed to registry)
 BITCOIN_UI_IMAGE="$ARCHY_REGISTRY/bitcoin-ui:1.7.123-alpha"