feat: dynamic app catalog, Gitea app polish, registry sync

App catalog served from Gitea repos (app-catalog) with 35 apps.
Nodes fetch catalog dynamically — new apps appear without frontend
rebuild. Test app added and removed to verify pipeline.

Gitea manifest updated with internal_port/nginx_proxy for iframe.
Updated catalog.json, nginx configs, app session configs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/gitea/manifest.yml

@@ -5,6 +5,7 @@ description: Self-hosted Git service with built-in container registry, CI/CD, an
 category: development
 icon: git-branch
 port: 3000
+internal_port: 3001
 ssh_port: 2222
 image: docker.io/gitea/gitea:1.23
 tier: optional
@@ -28,6 +29,16 @@ environment:
   GITEA__repository__ENABLE_PUSH_CREATE_USER: "true"
   GITEA__repository__ENABLE_PUSH_CREATE_ORG: "true"
 
+# Gitea hardcodes X-Frame-Options: SAMEORIGIN which blocks iframe embedding.
+# Container binds to internal_port (3001), nginx proxies public port (3000)
+# stripping the X-Frame-Options header so the app works in Archipelago's iframe.
+nginx_proxy:
+  listen: 3000
+  proxy_pass: "http://127.0.0.1:3001"
+  extra_headers:
+    - "proxy_hide_header X-Frame-Options"
+    - "proxy_hide_header Content-Security-Policy"
+
 health_check:
   endpoint: /
   interval: 120