feat: architecture review fixes, self-update system, CI pipeline, supply chain hardening

Architecture review (all P0+P1 issues now fixed):
- Add 10s timeout to 6 bare Nostr client.connect() calls
- Pin all 12 crypto deps to exact versions from Cargo.lock
- Pin all 15 floating container image tags to exact patch versions
- Add CI pipeline (cargo fmt + clippy + tests, frontend type-check + build)

Self-update system (git.tx1138.com):
- scripts/self-update.sh: pull, build, install, restart with rollback
- systemd timer checks daily at 3 AM
- update.check RPC does git-based checks when repo is present
- update.git-apply RPC triggers self-update from UI
- Default update URL changed from GitHub to git.tx1138.com
- Git added to ISO package list for fresh installs

Documentation:
- CHANGELOG v1.3.1 with all changes
- README updated (version, update system section)
- BETA-PROGRESS session #6 logged
- architecture-review.html: 4 issues marked FIXED, 8/12 refactoring done

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -8,7 +8,7 @@
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Rust](https://img.shields.io/badge/rust-stable-orange)](https://www.rust-lang.org/)
 [![Vue.js](https://img.shields.io/badge/vue.js-3.5-brightgreen)](https://vuejs.org/)
-[![Version](https://img.shields.io/badge/version-0.1.0--beta-blue)]()
+[![Version](https://img.shields.io/badge/version-1.3.1--beta-blue)]()
 
 ## Features
 
@@ -41,13 +41,20 @@ Bitcoin (ThunderHub), Storage (FileBrowser, Immich, Nextcloud), Productivity (Pe
 - Device discovery and mesh routing
 - Off-grid Bitcoin balance checks (planned)
 
+### System Updates
+- OTA updates from self-hosted Gitea (git.tx1138.com) with SHA256 verification
+- Three update modes: Manual, Daily Check, Auto Apply (3 AM window)
+- Rollback support with automatic backup before applying
+- Full UI for update management in Settings
+
 ### Security
-- ChaCha20-Poly1305 encrypted secrets at rest, Argon2 password hashing
+- ChaCha20-Poly1305 encrypted secrets at rest, Argon2id password hashing
 - Rootless Podman: read-only root, cap-drop ALL, non-root user, no-new-privileges
 - TOTP two-factor authentication
 - Per-endpoint rate limiting, CSRF protection, input validation
 - AppArmor profiles for container confinement
 - Tor hidden services for all inter-node communication
+- All crypto and container dependencies pinned to exact versions
 - Full penetration test completed (33 findings, all remediated)
 
 ## Quick Start