release(v1.7.2-alpha): fix Install Update + identity avatar backfill + label

Three user-visible fixes shipped together.

1. update.apply permission-denied
   apply_update() was doing fs::copy into /usr/local/bin/archipelago and
   tar xzf into /opt/archipelago as the archipelago user — both root-owned.
   The backup step succeeded (it wrote to data_dir) but the swap failed
   with a silent permission denied, wrapped as "Failed to apply archipelago".
   Now uses `sudo install -m 0755` for the binary and `sudo tar -xzf` for
   the frontend, plus a post-apply `sudo systemctl --no-block restart
   archipelago` scheduled 2s after the RPC reply so the UI sees success.

2. Apply → Install label
   en/es locale strings: applyUpdate / applyTitle / applyNow changed from
   "Apply" to "Install". Matches the user's mental model and distinguishes
   the user-facing verb from the internal apply_update() function.

3. Identity avatar backfill
   Identities created before df83163f had profile=None on disk and so
   rendered as initials. load_record() now synthesizes an IdentityProfile
   with a default picture (identicon for regular identities, the hex node
   SVG for derivation_index=0) when profile is missing. The synthetic
   profile lives only in the returned record; the file stays untouched so
   a later explicit Save persists whatever the user actually chose.

Artefacts:
  archipelago                                        70e5444e…67c589  40381960
  archipelago-frontend-1.7.2-alpha.tar.gz            806b027b…358a824 76983699

Changelog rewritten layman-style per saved feedback.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/archipelago/src/identity_manager.rs

@@ -739,6 +739,20 @@ impl IdentityManager {
                 .and_then(|pk| pk.to_bech32().ok())
         });
 
+        // Backfill a default avatar for identities created before the
+        // default-avatar feature shipped. The synthetic profile lives only
+        // in the returned record — we don't rewrite the file on disk,
+        // since a later explicit save will persist whatever the user
+        // actually chose. Master identities (seed index 0) get the hex
+        // node SVG; all other pre-existing identities get the identicon.
+        let profile = file.profile.or_else(|| {
+            let is_master = file.derivation_index == Some(0);
+            Some(IdentityProfile {
+                picture: Some(crate::avatar::default_picture(&file.pubkey_hex, is_master)),
+                ..Default::default()
+            })
+        });
+
         Ok(IdentityRecord {
             id: file.id,
             name: file.name,
@@ -749,7 +763,7 @@ impl IdentityManager {
             created_at: file.created_at,
             nostr_pubkey: file.nostr_pubkey_hex,
             nostr_npub,
-            profile: file.profile,
+            profile,
         })
     }