fix: auth, container resilience, ISO build, gamepad polish

- fix: login disconnect — verify session before WebSocket connect
- fix: 403 on app install — distinguish CSRF vs RBAC errors, only retry CSRF
- fix: health monitor now watches ALL containers (removed skip list for
  backend services like nbxplorer, databases, UI containers)
- fix: server.get-state added to CSRF-exempt list (read-only)
- fix: ISO build includes container-specs.sh and lib/common.sh in rootfs
  so reconcile actually works on fresh installs
- fix: gamepad nav — improved Server tab zone nav, focus styles, autofocus
- chore: move L484 web-only apps to Services tab
- chore: install store for cross-view install tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/tests/orchestration_tests.rs

@@ -359,28 +359,31 @@ mod health_monitor_logic {
     }
 
     #[test]
-    fn ui_containers_skipped() {
+    fn all_long_running_containers_monitored() {
+        // Health monitor now checks ALL containers except ephemeral build/init ones.
+        // Backend services and UI containers are monitored for auto-restart.
         let containers = vec![
             ("bitcoin-knots", "exited"),
             ("archy-bitcoin-ui", "exited"),
             ("archy-lnd-ui", "exited"),
             ("grafana", "exited"),
+            ("nbxplorer", "exited"),
+            ("indeedhub-build_api_1", "exited"),
+            ("btcpay-init", "exited"),
         ];
 
-        let skip_suffixes = ["-ui"];
-        let skip_backends = ["btcpay-db", "nbxplorer", "mempool-db", "mempool-api"];
-
         let to_check: Vec<&str> = containers
             .iter()
             .filter(|(name, _)| {
-                let id = name.strip_prefix("archy-").unwrap_or(name);
-                !skip_suffixes.iter().any(|s| id.ends_with(s))
-                    && !skip_backends.contains(&id)
+                !name.starts_with("indeedhub-build_") && !name.contains("-init")
             })
             .map(|(name, _)| *name)
             .collect();
 
-        assert_eq!(to_check, vec!["bitcoin-knots", "grafana"]);
+        assert_eq!(to_check, vec![
+            "bitcoin-knots", "archy-bitcoin-ui", "archy-lnd-ui",
+            "grafana", "nbxplorer",
+        ]);
     }
 
     #[test]