security+feat: v1.3.0 — pentest remediation, container reliability, UI overhaul

Security (33 pentest findings addressed):
- CRITICAL: backend binds 127.0.0.1, path traversal in tor.rs/dwn fixed
- HIGH: federation requires signatures, XSS login redirect, RBAC viewer restricted
- HIGH: tar slip prevention, S3 SSRF validation, backup ID validation
- MEDIUM: remember-me random secret, TOTP session rotation, password re-auth
- LOW: CSP unsafe-inline removed, CORS dev-only, onion/webhook validation

Container reliability:
- Memory limits on all 37 containers (OOM prevention)
- Exited vs stopped state distinction with health-aware status badges
- Crash recovery coordination (no more restart cascade)
- User-stopped tracking survives reboots
- Tiered boot recovery (databases → core → services → apps)

UI:
- Wallet TransactionsModal, health-aware app status badges
- Restart button on containers, exited/crashed red state
- Mesh view overhaul, glass button updates, BaseModal/ToggleSwitch
- Apps sticky header removed, dev faucet, mutable mock wallet

Infrastructure:
- LND REST port 8080 exposed over Tor (LND Connect fix)
- Nginx cookie_session fix, deploy script Tor config updated
- Dev environment: podman auto-start, boot mode simulation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/container/src/runtime.rs

@@ -284,6 +284,8 @@ impl ContainerRuntime for DockerRuntime {
             id: parts[0].to_string(),
             name: parts[1].to_string(),
             state: crate::podman_client::ContainerState::from(parts[2]),
+            health: None,
+            started_at: None,
             image: parts[3].to_string(),
             created: parts[4].to_string(),
             ports: vec![],
@@ -356,6 +358,8 @@ impl ContainerRuntime for DockerRuntime {
                 state: ContainerState::from(
                     container["State"].as_str().unwrap_or("unknown")
                 ),
+                health: None,
+                started_at: None,
                 image: container["Image"].as_str().unwrap_or("").to_string(),
                 created: container["CreatedAt"].as_str().unwrap_or("").to_string(),
                 ports,