fix: WebSocket reconnect state refresh, listener leak fixes, pin container images

- F4: Fetch fresh server state after WebSocket reconnect
- F5: Guard message polling timer with auth check, stop on logout
- F6: Remove NIP-07 listener in appLauncher close()
- F7: Initialize audio player once to prevent listener stacking
- S3: Pin all container images to specific versions, create image-versions.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/container-doctor.sh

@@ -20,6 +20,10 @@
 
 set -o pipefail
 
+# Source pinned image versions (single source of truth)
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+[ -f "$SCRIPT_DIR/image-versions.sh" ] && . "$SCRIPT_DIR/image-versions.sh"
+
 FIXES_APPLIED=0
 CHECKS_PASSED=0
 FIX_NAMES=()
@@ -194,7 +198,7 @@ fix_searxng() {
         -v searxng-cache:/var/cache/searxng:rw \
         -p "${host_port}:8080" \
         --memory=512m \
-        docker.io/searxng/searxng:latest 2>&1 || true
+        "${SEARXNG_IMAGE:-docker.io/searxng/searxng:2024.11.17}" 2>&1 || true
 
     log "SearXNG recreated (no readonly, no cap-drop ALL)"
     return 0