fix: BUG-1 CSRF, TASK-8 H2/H3/H4, BUG-20/37/40/41 — 7 bugs fixed

BUG-1 (P0): CSRF tokens now HMAC-derived from session token instead of
random — survives backend restarts, eliminates cookie/header race conditions.
Frontend retries 403s as belt-and-suspenders.

TASK-8 H2: federation.peer-joined verifies ed25519 signature on join messages.
TASK-8 H3: federation.peer-address-changed requires signed proof from known peer.
TASK-8 H4: Rust backend default bind 0.0.0.0 → 127.0.0.1 (nginx proxies all).

BUG-20: ElectrumX index estimate string fixed from ~55GB to ~130GB.
BUG-37: App card Start/Stop buttons split into loading vs interactive states
        to prevent WebSocket state flicker during container scans.
BUG-40: Uninstall modal uses Teleport to body with z-[3000] for full overlay.
BUG-41: Uninstalling overlay on card + optimistic store removal.

Updated MASTER_PLAN.md and BETA-PROGRESS.md to reflect all completed work.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/api/rpc-client.ts

@@ -68,6 +68,12 @@ class RPCClient {
             }
             throw new Error('Session expired')
           }
+          // CSRF 403: retry once after short delay (cookie may have been
+          // updated by a concurrent Set-Cookie response not yet visible to JS)
+          if (response.status === 403 && attempt < maxRetries - 1) {
+            await new Promise((r) => setTimeout(r, 300))
+            continue
+          }
           const err = new Error(`HTTP ${response.status}: ${response.statusText}`)
           const isRetryable = response.status === 502 || response.status === 503
           if (isRetryable && attempt < maxRetries - 1) {