fix: add NET_RAW capability to LND container for TLS cert generation

LND crashes with "netlinkrib: address family not supported by protocol"
in rootless podman because it needs NET_RAW to enumerate network
interfaces during TLS certificate generation. Added to capabilities
in config.rs, first-boot-containers.sh, and container-specs.sh.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/package/config.rs

@@ -82,6 +82,7 @@ pub(super) fn get_app_capabilities(app_id: &str) -> Vec<String> {
             "--cap-add=NET_BIND_SERVICE".to_string(),
         ],
         // Bitcoin and Lightning need file ownership ops + NET_BIND_SERVICE for port binding
+        // LND additionally needs NET_RAW for TLS certificate generation (netlinkrib interface enumeration)
         "bitcoin" | "bitcoin-core" | "bitcoin-knots" | "lnd" | "fedimint"
         | "fedimint-gateway" => vec![
             "--cap-add=CHOWN".to_string(),
@@ -90,6 +91,7 @@ pub(super) fn get_app_capabilities(app_id: &str) -> Vec<String> {
             "--cap-add=SETGID".to_string(),
             "--cap-add=DAC_OVERRIDE".to_string(),
             "--cap-add=NET_BIND_SERVICE".to_string(),
+            "--cap-add=NET_RAW".to_string(),
         ],
         // Vaultwarden needs file ownership + NET_BIND_SERVICE (binds port 80 internally)
         "vaultwarden" => vec![