fix: auth, container resilience, ISO build, gamepad polish

- fix: login disconnect — verify session before WebSocket connect
- fix: 403 on app install — distinguish CSRF vs RBAC errors, only retry CSRF
- fix: health monitor now watches ALL containers (removed skip list for
  backend services like nbxplorer, databases, UI containers)
- fix: server.get-state added to CSRF-exempt list (read-only)
- fix: ISO build includes container-specs.sh and lib/common.sh in rootfs
  so reconcile actually works on fresh installs
- fix: gamepad nav — improved Server tab zone nav, focus styles, autofocus
- chore: move L484 web-only apps to Services tab
- chore: install store for cross-view install tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/mod.rs

@@ -220,7 +220,8 @@ impl RpcHandler {
         // Skip CSRF for read-only methods (polling, status) — CSRF prevents state-changing forgery.
         // Skip when session was just auto-restored from remember-me (browser has stale CSRF cookie).
         let csrf_exempt = matches!(rpc_req.method.as_str(),
-            "node-messages-received" | "server.echo" | "system.stats" | "tor.status"
+            "node-messages-received" | "server.echo" | "server.get-state"
+            | "system.stats" | "tor.status"
             | "tor.onion-addresses" | "federation.list-nodes" | "system.get-settings"
             | "system.get-node-key" | "system.get-metrics" | "system.get-version"
         );

core/archipelago/src/health_monitor.rs

@@ -326,13 +326,9 @@ async fn check_containers() -> Vec<ContainerHealth> {
     let containers: Vec<serde_json::Value> =
         serde_json::from_str(&stdout).unwrap_or_default();
 
-    // Backend services and one-shot init containers to skip
-    let skip = [
-        "btcpay-db", "nbxplorer", "mempool-db", "mempool-api",
-        "penpot-postgres", "penpot-backend", "penpot-exporter", "penpot-valkey",
-        "penpot-mailcatch", "immich_postgres", "immich_redis",
-        "endurain-db", "nextcloud-db",
-    ];
+    // Monitor ALL long-running containers for health — backend services (databases,
+    // nbxplorer, mempool-api) and UI containers need auto-restart too.
+    // Only skip ephemeral containers (build infrastructure, init one-shots).
 
     containers
         .iter()
@@ -345,20 +341,16 @@ async fn check_containers() -> Vec<ContainerHealth> {
                 }
             })?;
 
-            let app_id = name
-                .strip_prefix("archy-")
-                .unwrap_or(&name)
-                .to_string();
-
-            if skip.contains(&app_id.as_str()) || app_id.ends_with("-ui") {
-                return None;
-            }
-
             // Skip podman-compose infrastructure and one-shot init containers
             if name.starts_with("indeedhub-build_") || name.contains("-init") {
                 return None;
             }
 
+            let app_id = name
+                .strip_prefix("archy-")
+                .unwrap_or(&name)
+                .to_string();
+
             let state = c.get("State")
                 .and_then(|v| v.as_str())
                 .unwrap_or("unknown")

core/archipelago/tests/orchestration_tests.rs

@@ -359,28 +359,31 @@ mod health_monitor_logic {
     }
 
     #[test]
-    fn ui_containers_skipped() {
+    fn all_long_running_containers_monitored() {
+        // Health monitor now checks ALL containers except ephemeral build/init ones.
+        // Backend services and UI containers are monitored for auto-restart.
         let containers = vec![
             ("bitcoin-knots", "exited"),
             ("archy-bitcoin-ui", "exited"),
             ("archy-lnd-ui", "exited"),
             ("grafana", "exited"),
+            ("nbxplorer", "exited"),
+            ("indeedhub-build_api_1", "exited"),
+            ("btcpay-init", "exited"),
         ];
 
-        let skip_suffixes = ["-ui"];
-        let skip_backends = ["btcpay-db", "nbxplorer", "mempool-db", "mempool-api"];
-
         let to_check: Vec<&str> = containers
             .iter()
             .filter(|(name, _)| {
-                let id = name.strip_prefix("archy-").unwrap_or(name);
-                !skip_suffixes.iter().any(|s| id.ends_with(s))
-                    && !skip_backends.contains(&id)
+                !name.starts_with("indeedhub-build_") && !name.contains("-init")
             })
             .map(|(name, _)| *name)
             .collect();
 
-        assert_eq!(to_check, vec!["bitcoin-knots", "grafana"]);
+        assert_eq!(to_check, vec![
+            "bitcoin-knots", "archy-bitcoin-ui", "archy-lnd-ui",
+            "grafana", "nbxplorer",
+        ]);
     }
 
     #[test]