fix: WebSocket reconnect state refresh, listener leak fixes, pin container images

- F4: Fetch fresh server state after WebSocket reconnect
- F5: Guard message polling timer with auth check, stop on logout
- F6: Remove NIP-07 listener in appLauncher close()
- F7: Initialize audio player once to prevent listener stacking
- S3: Pin all container images to specific versions, create image-versions.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/archipelago-scripts/archipelago-menu.sh

@@ -240,7 +240,7 @@ setup_btcpay() {
     
     echo ""
     echo "  🐳 Pulling BTCPay Server image..."
-    podman pull docker.io/btcpayserver/btcpayserver:latest
+    podman pull "${BTCPAY_IMAGE:-docker.io/btcpayserver/btcpayserver:1.14.5}"
     
     # Create data directory
     mkdir -p ~/.btcpay

image-recipe/build-auto-installer-iso.sh

@@ -24,6 +24,10 @@
 
 set -e
 
+# Source pinned image versions (single source of truth)
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+[ -f "$SCRIPT_DIR/../scripts/image-versions.sh" ] && . "$SCRIPT_DIR/../scripts/image-versions.sh"
+
 # Configuration
 DEV_SERVER="${DEV_SERVER:-archipelago@192.168.1.228}"
 BUILD_FROM_SOURCE="${BUILD_FROM_SOURCE:-0}"
@@ -597,37 +601,37 @@ fi
 # bitcoin-ui and lnd-ui are custom and normally captured from server or built separately.
 # Alpha: core Bitcoin/Lightning stack + essential apps. Others pulled on-demand from Marketplace.
 CONTAINER_IMAGES="
-docker.io/bitcoinknots/bitcoin:latest bitcoin-knots.tar
-docker.io/lightninglabs/lnd:v0.18.4-beta lnd.tar
-docker.io/homeassistant/home-assistant:2024.1 homeassistant.tar
-docker.io/btcpayserver/btcpayserver:1.13.5 btcpayserver.tar
-docker.io/nicolasdorier/nbxplorer:2.6.0 nbxplorer.tar
-docker.io/library/postgres:15-alpine postgres-btcpay.tar
-docker.io/mempool/frontend:v2.5.0 mempool-frontend.tar
-docker.io/mempool/backend:v2.5.0 mempool-backend.tar
-docker.io/lukechilds/electrumx:v1.18.0 electrumx.tar
-docker.io/library/mariadb:10.11 mariadb-mempool.tar
-docker.io/fedimint/fedimintd:v0.10.0 fedimint.tar
-docker.io/fedimint/gatewayd:v0.10.0 fedimint-gateway.tar
-docker.io/filebrowser/filebrowser:v2.27.0 filebrowser.tar
-docker.io/andrius/alpine-tor:latest alpine-tor.tar
-docker.io/library/nginx:alpine nginx-alpine.tar
+${BITCOIN_KNOTS_IMAGE:-docker.io/bitcoinknots/bitcoin:v28.1} bitcoin-knots.tar
+${LND_IMAGE:-docker.io/lightninglabs/lnd:v0.18.5-beta} lnd.tar
+${HOMEASSISTANT_IMAGE:-ghcr.io/home-assistant/home-assistant:2024.12} homeassistant.tar
+${BTCPAY_IMAGE:-docker.io/btcpayserver/btcpayserver:1.14.5} btcpayserver.tar
+${NBXPLORER_IMAGE:-docker.io/nicolasdorier/nbxplorer:2.5.13} nbxplorer.tar
+${POSTGRES_IMAGE:-docker.io/library/postgres:16} postgres-btcpay.tar
+${MEMPOOL_API_IMAGE:-docker.io/mempool/frontend:v3.0.0} mempool-frontend.tar
+${MEMPOOL_WEB_IMAGE:-docker.io/mempool/frontend:v3.0.0} mempool-backend.tar
+${ELECTRUMX_IMAGE:-docker.io/lukechilds/electrumx:v1.16.0} electrumx.tar
+${MARIADB_IMAGE:-docker.io/library/mariadb:11.4} mariadb-mempool.tar
+${FEDIMINT_IMAGE:-docker.io/fedimint/fedimintd:v0.5.1} fedimint.tar
+${FEDIMINT_GATEWAY_IMAGE:-docker.io/fedimint/gatewayd:v0.5.1} fedimint-gateway.tar
+${FILEBROWSER_IMAGE:-docker.io/filebrowser/filebrowser:v2} filebrowser.tar
+${ALPINE_TOR_IMAGE:-docker.io/andrius/alpine-tor:0.4.8.13} alpine-tor.tar
+${NGINX_ALPINE_IMAGE:-docker.io/library/nginx:alpine} nginx-alpine.tar
 ghcr.io/tbd54566975/dwn-server:main dwn-server.tar
-docker.io/grafana/grafana:10.2.0 grafana.tar
-docker.io/louislam/uptime-kuma:1 uptime-kuma.tar
-docker.io/vaultwarden/server:1.30.0-alpine vaultwarden.tar
-docker.io/searxng/searxng:latest searxng.tar
-docker.io/portainer/portainer-ce:2.19.4 portainer.tar
-docker.io/tailscale/tailscale:stable tailscale.tar
-docker.io/jellyfin/jellyfin:10.8.13 jellyfin.tar
-docker.io/photoprism/photoprism:latest photoprism.tar
-docker.io/library/nextcloud:28-apache nextcloud.tar
-docker.io/jc21/nginx-proxy-manager:latest nginx-proxy-manager.tar
-ghcr.io/immich-app/immich-server:release immich-server.tar
+${GRAFANA_IMAGE:-docker.io/grafana/grafana:11.4.0} grafana.tar
+${UPTIME_KUMA_IMAGE:-docker.io/louislam/uptime-kuma:1} uptime-kuma.tar
+${VAULTWARDEN_IMAGE:-docker.io/vaultwarden/server:1.32.5} vaultwarden.tar
+${SEARXNG_IMAGE:-docker.io/searxng/searxng:2024.11.17} searxng.tar
+${PORTAINER_IMAGE:-docker.io/portainer/portainer-ce:2.21.5} portainer.tar
+${TAILSCALE_IMAGE:-docker.io/tailscale/tailscale:v1.78.3} tailscale.tar
+${JELLYFIN_IMAGE:-docker.io/jellyfin/jellyfin:10.10.3} jellyfin.tar
+${PHOTOPRISM_IMAGE:-docker.io/photoprism/photoprism:240915} photoprism.tar
+${NEXTCLOUD_IMAGE:-docker.io/library/nextcloud:30} nextcloud.tar
+${NPM_IMAGE:-docker.io/jc21/nginx-proxy-manager:2} nginx-proxy-manager.tar
+${IMMICH_IMAGE:-ghcr.io/immich-app/immich-server:v1.123.0} immich-server.tar
 docker.io/library/postgres:14-alpine postgres-immich.tar
-docker.io/library/redis:7-alpine redis-immich.tar
-docker.io/onlyoffice/documentserver:8.0 onlyoffice.tar
-docker.io/adguard/adguardhome:latest adguardhome.tar
+${INDEEDHUB_REDIS_IMAGE:-docker.io/library/redis:7-alpine} redis-immich.tar
+${ONLYOFFICE_IMAGE:-docker.io/onlyoffice/documentserver:8.2} onlyoffice.tar
+${ADGUARDHOME_IMAGE:-docker.io/adguard/adguardhome:v0.107.55} adguardhome.tar
 "
 
 # Pull and save each image (force target arch) only if not already present
@@ -806,7 +810,7 @@ else
         sudo $DOCKER run -d --name archy-tor --restart unless-stopped --network host \
             -v "$TOR_DIR:$TOR_DIR" \
             --entrypoint tor \
-            docker.io/andrius/alpine-tor:latest \
+            ${ALPINE_TOR_IMAGE:-docker.io/andrius/alpine-tor:0.4.8.13} \
             -f /etc/tor/torrc >> "$LOG" 2>&1
         echo "$(date): Tor container started" >> "$LOG"
     fi