feat: bitcoin-ui CSS fix, HTTPS proxy support, deploy script improvements

Bitcoin UI:
- Replace cdn.tailwindcss.com with locally bundled tailwind.css (CSP blocks external scripts)
- Make all asset paths relative for nginx proxy compatibility
- Add bitcoin-ui build/deploy to deploy-to-target.sh (was missing entirely)
- Use --network host (bitcoin-ui proxies Bitcoin RPC at 127.0.0.1:8332)

HTTPS mixed content fix:
- Add HTTPS_PROXY_PATHS in AppSession.vue — when parent page is HTTPS,
  iframe loads through nginx proxy instead of direct HTTP port
- Prevents browser blocking HTTP iframes inside HTTPS pages
- All Tailscale servers use HTTPS, this was breaking all app iframes

Deploy & first-boot improvements:
- first-boot-containers.sh auto-detects disk size for pruning vs txindex
- first-boot-containers.sh checks fallback source path for UI containers
- Added mempool-electrs to APP_PORTS mapping
- ElectrumX container creation in first-boot
- Podman doctor/fix/uptime skills added

Also includes: session persistence, identity management, LND transactions,
ElectrumX status UI, nostr-provider improvements, Web5 enhancements

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -590,7 +590,7 @@ docker.io/nicolasdorier/nbxplorer:2.6.0 nbxplorer.tar
 docker.io/library/postgres:15-alpine postgres-btcpay.tar
 docker.io/mempool/frontend:v2.5.0 mempool-frontend.tar
 docker.io/mempool/backend:v2.5.0 mempool-backend.tar
-docker.io/mempool/electrs:latest mempool-electrs.tar
+docker.io/lukechilds/electrumx:v1.18.0 electrumx.tar
 docker.io/library/mariadb:10.11 mariadb-mempool.tar
 docker.io/fedimint/fedimintd:v0.10.0 fedimint.tar
 docker.io/fedimint/gatewayd:v0.10.0 fedimint-gateway.tar
@@ -735,7 +735,7 @@ import json
 services = [
     {"name": "archipelago", "local_port": 80, "enabled": True},
     {"name": "bitcoin", "local_port": 8333, "enabled": True},
-    {"name": "electrs", "local_port": 50001, "enabled": True},
+    {"name": "electrumx", "local_port": 50001, "enabled": True},
     {"name": "lnd", "local_port": 9735, "enabled": True},
     {"name": "btcpay", "local_port": 23000, "enabled": True},
     {"name": "mempool", "local_port": 4080, "enabled": True},
@@ -757,7 +757,7 @@ HiddenServicePort 80 127.0.0.1:80
 HiddenServiceDir $TOR_DIR/hidden_service_bitcoin
 HiddenServicePort 8333 127.0.0.1:8333
 
-HiddenServiceDir $TOR_DIR/hidden_service_electrs
+HiddenServiceDir $TOR_DIR/hidden_service_electrumx
 HiddenServicePort 50001 127.0.0.1:50001
 
 HiddenServiceDir $TOR_DIR/hidden_service_lnd

image-recipe/configs/nginx-archipelago.conf

@@ -11,7 +11,7 @@ server {
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-src *" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss: http://$host:*; frame-src *" always;
 
     # AIUI SPA (Chat mode iframe)
     # Use =404 fallback instead of index.html to prevent serving HTML with wrong
@@ -487,7 +487,7 @@ server {
         sub_filter_once on;
         sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
     }
-    location /app/electrs/ {
+    location /app/electrumx/ {
         proxy_pass http://127.0.0.1:50002/;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
@@ -675,7 +675,7 @@ server {
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-src *" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss: http://$host:*; frame-src *" always;
 
     # AIUI SPA (Chat mode iframe)
     location /aiui/ {

image-recipe/configs/snippets/archipelago-https-app-proxies.conf

@@ -218,7 +218,7 @@ location /app/bitcoin-ui/ {
     sub_filter_once on;
     sub_filter '</head>' '<script src="/nostr-provider.js"></script></head>';
 }
-location /app/electrs/ {
+location /app/electrumx/ {
     proxy_pass http://127.0.0.1:50002/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;