fix: container orchestration overhaul — names, errors, Tor, restart

Container name resolution:
- New all_container_names() — single source of truth for every app's
  container name variants (bitcoin-knots/bitcoin/bitcoin-core, etc.)
- Covers all historical naming patterns and multi-container stacks

Start/Stop/Restart:
- No more silent failures (let _ = podman...). Every operation logs
  the command, checks exit status, and returns real errors to the UI.
- Restart uses stop+start fallback when podman restart fails
  (handles rootless podman loopback adapter errors)
- "No containers found" error when app doesn't exist

Tor helper:
- Install archipelago-tor-helper.path + .service in rootfs
- Enable the path unit so backend can manage Tor as non-root
- Copy tor-helper.sh to /opt/archipelago/scripts/

Verified: container with proper caps can stop/start/restart cleanly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -339,12 +339,15 @@ COPY archipelago-doctor.service /etc/systemd/system/archipelago-doctor.service
 COPY archipelago-doctor.timer /etc/systemd/system/archipelago-doctor.timer
 COPY archipelago-reconcile.service /etc/systemd/system/archipelago-reconcile.service
 COPY archipelago-reconcile.timer /etc/systemd/system/archipelago-reconcile.timer
+COPY archipelago-tor-helper.service /etc/systemd/system/archipelago-tor-helper.service
+COPY archipelago-tor-helper.path /etc/systemd/system/archipelago-tor-helper.path
 
 # Copy container doctor + reconcile scripts (referenced by the services above)
 RUN mkdir -p /home/archipelago/archy/scripts
 COPY container-doctor.sh /home/archipelago/archy/scripts/container-doctor.sh
 COPY reconcile-containers.sh /home/archipelago/archy/scripts/reconcile-containers.sh
-RUN chmod +x /home/archipelago/archy/scripts/*.sh && \
+COPY tor-helper.sh /opt/archipelago/scripts/tor-helper.sh
+RUN chmod +x /home/archipelago/archy/scripts/*.sh /opt/archipelago/scripts/*.sh && \
     chown -R archipelago:archipelago /home/archipelago/archy
 
 # Enable services
@@ -357,7 +360,8 @@ RUN systemctl enable NetworkManager || true && \
     systemctl enable chrony || true && \
     systemctl enable archipelago-update.timer || true && \
     systemctl enable archipelago-doctor.timer || true && \
-    systemctl enable archipelago-reconcile.timer || true
+    systemctl enable archipelago-reconcile.timer || true && \
+    systemctl enable archipelago-tor-helper.path || true
 
 # Remove policy-rc.d so services can start on first boot
 RUN rm -f /usr/sbin/policy-rc.d
@@ -424,7 +428,7 @@ NGINXCONF
         cp "$SCRIPT_DIR/configs/archipelago-reconcile.service" "$WORK_DIR/archipelago-reconcile.service"
         cp "$SCRIPT_DIR/configs/archipelago-reconcile.timer" "$WORK_DIR/archipelago-reconcile.timer"
         # Copy the actual scripts the services reference
-        for s in container-doctor.sh reconcile-containers.sh; do
+        for s in container-doctor.sh reconcile-containers.sh tor-helper.sh; do
             if [ -f "$SCRIPT_DIR/../scripts/$s" ]; then
                 cp "$SCRIPT_DIR/../scripts/$s" "$WORK_DIR/$s"
             fi
@@ -432,6 +436,13 @@ NGINXCONF
         echo "   Using container doctor + reconcile timers from configs/"
     fi
 
+    # Copy Tor helper path-activated service (allows backend to manage Tor as non-root)
+    if [ -f "$SCRIPT_DIR/configs/archipelago-tor-helper.service" ]; then
+        cp "$SCRIPT_DIR/configs/archipelago-tor-helper.service" "$WORK_DIR/archipelago-tor-helper.service"
+        cp "$SCRIPT_DIR/configs/archipelago-tor-helper.path" "$WORK_DIR/archipelago-tor-helper.path"
+        echo "   Using tor-helper path unit from configs/"
+    fi
+
     # Use archipelago.service from configs/ (User=root for Podman container access)
     if [ -f "$SCRIPT_DIR/configs/archipelago.service" ]; then
         cp "$SCRIPT_DIR/configs/archipelago.service" "$WORK_DIR/archipelago.service"