fix: auth, container resilience, ISO build, gamepad polish

- fix: login disconnect — verify session before WebSocket connect
- fix: 403 on app install — distinguish CSRF vs RBAC errors, only retry CSRF
- fix: health monitor now watches ALL containers (removed skip list for
  backend services like nbxplorer, databases, UI containers)
- fix: server.get-state added to CSRF-exempt list (read-only)
- fix: ISO build includes container-specs.sh and lib/common.sh in rootfs
  so reconcile actually works on fresh installs
- fix: gamepad nav — improved Server tab zone nav, focus styles, autofocus
- chore: move L484 web-only apps to Services tab
- chore: install store for cross-view install tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/mod.rs

@@ -220,7 +220,8 @@ impl RpcHandler {
         // Skip CSRF for read-only methods (polling, status) — CSRF prevents state-changing forgery.
         // Skip when session was just auto-restored from remember-me (browser has stale CSRF cookie).
         let csrf_exempt = matches!(rpc_req.method.as_str(),
-            "node-messages-received" | "server.echo" | "system.stats" | "tor.status"
+            "node-messages-received" | "server.echo" | "server.get-state"
+            | "system.stats" | "tor.status"
             | "tor.onion-addresses" | "federation.list-nodes" | "system.get-settings"
             | "system.get-node-key" | "system.get-metrics" | "system.get-version"
         );

core/archipelago/src/health_monitor.rs

@@ -326,13 +326,9 @@ async fn check_containers() -> Vec<ContainerHealth> {
     let containers: Vec<serde_json::Value> =
         serde_json::from_str(&stdout).unwrap_or_default();
 
-    // Backend services and one-shot init containers to skip
-    let skip = [
-        "btcpay-db", "nbxplorer", "mempool-db", "mempool-api",
-        "penpot-postgres", "penpot-backend", "penpot-exporter", "penpot-valkey",
-        "penpot-mailcatch", "immich_postgres", "immich_redis",
-        "endurain-db", "nextcloud-db",
-    ];
+    // Monitor ALL long-running containers for health — backend services (databases,
+    // nbxplorer, mempool-api) and UI containers need auto-restart too.
+    // Only skip ephemeral containers (build infrastructure, init one-shots).
 
     containers
         .iter()
@@ -345,20 +341,16 @@ async fn check_containers() -> Vec<ContainerHealth> {
                 }
             })?;
 
-            let app_id = name
-                .strip_prefix("archy-")
-                .unwrap_or(&name)
-                .to_string();
-
-            if skip.contains(&app_id.as_str()) || app_id.ends_with("-ui") {
-                return None;
-            }
-
             // Skip podman-compose infrastructure and one-shot init containers
             if name.starts_with("indeedhub-build_") || name.contains("-init") {
                 return None;
             }
 
+            let app_id = name
+                .strip_prefix("archy-")
+                .unwrap_or(&name)
+                .to_string();
+
             let state = c.get("State")
                 .and_then(|v| v.as_str())
                 .unwrap_or("unknown")