chore: Debian 12 → 13 (Trixie) migration, service hardening

- Update all references from Debian 12 (Bookworm) to Debian 13 (Trixie)
- Enable SystemCallArchitectures, RestrictAddressFamilies, RestrictRealtime
  in archipelago.service (safe on systemd 256+ which respects NoNewPrivileges=no)
- Update GLIBC compatibility checks from 2.36 to 2.40
- ISO filename, build container, and docs updated throughout

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/BETA-RELEASE-CHECKLIST.md

@@ -156,7 +156,7 @@ These must be tested in order on a fresh install:
 
 - [ ] Boot from USB on x86_64 hardware
 - [ ] Auto-installer partitions disk correctly
-- [ ] Debian 12 installs without errors
+- [ ] Debian 13 installs without errors
 - [ ] Archipelago services start on first boot
 - [ ] Web UI accessible at server IP within 3 minutes of first boot
 

docs/architecture.md

@@ -3,7 +3,7 @@
 > **Bitcoin Node OS** — Flash to USB, install on hardware, manage via web UI.
 
 **Stack**: Rust backend + Vue 3 + TypeScript (strict) + Vite 7 + Tailwind CSS + Pinia + rootless Podman
-**Target OS**: Debian 12 (Bookworm) — x86_64 and ARM64
+**Target OS**: Debian 13 (Trixie) — x86_64 and ARM64
 **Status**: Beta freeze (Phase 1: Feature Testing)
 
 For the full interactive architecture review with diagrams and learning guide, see [`architecture-review.html`](architecture-review.html).

docs/developer-guide.md

@@ -75,7 +75,7 @@ archy/
 ### Prerequisites
 
 - **macOS** (development machine): Node.js 20+, npm
-- **Linux server** (`192.168.1.228`): Rust toolchain, Podman, Nginx, Debian 12
+- **Linux server** (`192.168.1.228`): Rust toolchain, Podman, Nginx, Debian 13
 - SSH key: `~/.ssh/archipelago-deploy`
 
 ### Local Frontend Development