fix: WebSocket reconnect state refresh, listener leak fixes, pin container images

- F4: Fetch fresh server state after WebSocket reconnect
- F5: Guard message polling timer with auth check, stop on logout
- F6: Remove NIP-07 listener in appLauncher close()
- F7: Initialize audio player once to prevent listener stacking
- S3: Pin all container images to specific versions, create image-versions.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/image-versions.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+# Container image versions — single source of truth
+# Source this file from all scripts that create containers
+#
+# Usage: source /opt/archipelago/image-versions.sh 2>/dev/null || true
+#        source "$(dirname "$0")/image-versions.sh" 2>/dev/null || true
+
+# Bitcoin stack
+BITCOIN_KNOTS_IMAGE="docker.io/bitcoinknots/bitcoin:v28.1"
+LND_IMAGE="docker.io/lightninglabs/lnd:v0.18.5-beta"
+ELECTRUMX_IMAGE="docker.io/lukechilds/electrumx:v1.16.0"
+
+# Mempool stack
+MEMPOOL_API_IMAGE="docker.io/mempool/frontend:v3.0.0"
+MEMPOOL_WEB_IMAGE="docker.io/mempool/frontend:v3.0.0"
+MARIADB_IMAGE="docker.io/library/mariadb:11.4"
+
+# BTCPay
+BTCPAY_IMAGE="docker.io/btcpayserver/btcpayserver:1.14.5"
+NBXPLORER_IMAGE="docker.io/nicolasdorier/nbxplorer:2.5.13"
+POSTGRES_IMAGE="docker.io/library/postgres:16"
+
+# Apps
+HOMEASSISTANT_IMAGE="ghcr.io/home-assistant/home-assistant:2024.12"
+GRAFANA_IMAGE="docker.io/grafana/grafana:11.4.0"
+UPTIME_KUMA_IMAGE="docker.io/louislam/uptime-kuma:1"
+JELLYFIN_IMAGE="docker.io/jellyfin/jellyfin:10.10.3"
+PHOTOPRISM_IMAGE="docker.io/photoprism/photoprism:240915"
+OLLAMA_IMAGE="docker.io/ollama/ollama:0.5.4"
+VAULTWARDEN_IMAGE="docker.io/vaultwarden/server:1.32.5"
+NEXTCLOUD_IMAGE="docker.io/library/nextcloud:30"
+SEARXNG_IMAGE="docker.io/searxng/searxng:2024.11.17"
+ONLYOFFICE_IMAGE="docker.io/onlyoffice/documentserver:8.2"
+FILEBROWSER_IMAGE="docker.io/filebrowser/filebrowser:v2"
+NPM_IMAGE="docker.io/jc21/nginx-proxy-manager:2"
+PORTAINER_IMAGE="docker.io/portainer/portainer-ce:2.21.5"
+
+# Networking
+TAILSCALE_IMAGE="docker.io/tailscale/tailscale:v1.78.3"
+ALPINE_TOR_IMAGE="docker.io/andrius/alpine-tor:0.4.8.13"
+ADGUARDHOME_IMAGE="docker.io/adguard/adguardhome:v0.107.55"
+
+# Fedimint
+FEDIMINT_IMAGE="docker.io/fedimint/fedimintd:v0.5.1"
+FEDIMINT_GATEWAY_IMAGE="docker.io/fedimint/gatewayd:v0.5.1"
+
+# Media
+IMMICH_IMAGE="ghcr.io/immich-app/immich-server:v1.123.0"
+REDIS_IMAGE="docker.io/library/redis:7"
+
+# Penpot
+PENPOT_BACKEND_IMAGE="docker.io/penpotapp/backend:2.4.2"
+PENPOT_FRONTEND_IMAGE="docker.io/penpotapp/frontend:2.4.2"
+PENPOT_EXPORTER_IMAGE="docker.io/penpotapp/exporter:2.4.2"
+VALKEY_IMAGE="docker.io/valkey/valkey:8"
+
+# Nostr
+NOSTR_RS_RELAY_IMAGE="docker.io/scsibug/nostr-rs-relay:0.9.0"
+STRFRY_IMAGE="docker.io/pluja/strfry:latest"  # No stable tag available yet
+
+# IndeedHub stack (local builds use :local tag, not :latest)
+MINIO_IMAGE="docker.io/minio/minio:RELEASE.2024-11-07T00-52-20Z"
+INDEEDHUB_POSTGRES_IMAGE="docker.io/library/postgres:16-alpine"
+INDEEDHUB_REDIS_IMAGE="docker.io/library/redis:7-alpine"
+
+# Base images
+NGINX_ALPINE_IMAGE="docker.io/library/nginx:alpine"