fix: auth, container resilience, ISO build, gamepad polish

- fix: login disconnect — verify session before WebSocket connect
- fix: 403 on app install — distinguish CSRF vs RBAC errors, only retry CSRF
- fix: health monitor now watches ALL containers (removed skip list for
  backend services like nbxplorer, databases, UI containers)
- fix: server.get-state added to CSRF-exempt list (read-only)
- fix: ISO build includes container-specs.sh and lib/common.sh in rootfs
  so reconcile actually works on fresh installs
- fix: gamepad nav — improved Server tab zone nav, focus styles, autofocus
- chore: move L484 web-only apps to Services tab
- chore: install store for cross-view install tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -343,11 +343,13 @@ COPY archipelago-tor-helper.service /etc/systemd/system/archipelago-tor-helper.s
 COPY archipelago-tor-helper.path /etc/systemd/system/archipelago-tor-helper.path
 
 # Copy container doctor + reconcile scripts (referenced by the services above)
-RUN mkdir -p /home/archipelago/archy/scripts
+RUN mkdir -p /home/archipelago/archy/scripts/lib
 COPY container-doctor.sh /home/archipelago/archy/scripts/container-doctor.sh
 COPY reconcile-containers.sh /home/archipelago/archy/scripts/reconcile-containers.sh
+COPY container-specs.sh /home/archipelago/archy/scripts/container-specs.sh
 COPY tor-helper.sh /opt/archipelago/scripts/tor-helper.sh
-RUN chmod +x /home/archipelago/archy/scripts/*.sh /opt/archipelago/scripts/*.sh && \
+COPY lib/ /home/archipelago/archy/scripts/lib/
+RUN chmod +x /home/archipelago/archy/scripts/*.sh /home/archipelago/archy/scripts/lib/*.sh /opt/archipelago/scripts/*.sh && \
     chown -R archipelago:archipelago /home/archipelago/archy
 
 # Enable services
@@ -428,11 +430,16 @@ NGINXCONF
         cp "$SCRIPT_DIR/configs/archipelago-reconcile.service" "$WORK_DIR/archipelago-reconcile.service"
         cp "$SCRIPT_DIR/configs/archipelago-reconcile.timer" "$WORK_DIR/archipelago-reconcile.timer"
         # Copy the actual scripts the services reference
-        for s in container-doctor.sh reconcile-containers.sh tor-helper.sh; do
+        for s in container-doctor.sh reconcile-containers.sh container-specs.sh tor-helper.sh; do
             if [ -f "$SCRIPT_DIR/../scripts/$s" ]; then
                 cp "$SCRIPT_DIR/../scripts/$s" "$WORK_DIR/$s"
             fi
         done
+        # Copy shared script library (mem_limit etc.)
+        if [ -d "$SCRIPT_DIR/../scripts/lib" ]; then
+            mkdir -p "$WORK_DIR/lib"
+            cp "$SCRIPT_DIR/../scripts/lib/"*.sh "$WORK_DIR/lib/" 2>/dev/null || true
+        fi
         echo "   Using container doctor + reconcile timers from configs/"
     fi