fix: container install flow, filebrowser auth, AppCard enrichment

- Fix .198-style fresh installs: systemd service ExecStartPre creates
  /run/user/1000, enable podman.socket, chmod 644 /etc/hosts
- Filebrowser: add /data volume for database (fixes read-only crash),
  secure auth with random password via backend RPC (no more admin/admin)
- AppCard: enrich installing state with marketplace metadata (icon,
  title, description, tier badge, author, version)
- Registry: btcpayserver 1.13.5 → 1.13.7, images mirrored
- ReadWritePaths: add home container paths for rootless podman

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/scripts/install-podman.sh

@@ -52,6 +52,15 @@ mkdir -p /home/archipelago/.config/systemd/user
 # Enable lingering for archipelago user (allows user services to run without login)
 loginctl enable-linger archipelago || true
 
+# Ensure /run/user/1000 exists for podman socket
+mkdir -p /run/user/1000
+chown archipelago:archipelago /run/user/1000
+chmod 700 /run/user/1000
+
+# Enable podman API socket for archipelago user (backend connects via this)
+su - archipelago -c "XDG_RUNTIME_DIR=/run/user/1000 systemctl --user enable podman.socket" || true
+su - archipelago -c "XDG_RUNTIME_DIR=/run/user/1000 systemctl --user start podman.socket" || true
+
 # Set proper permissions
 chown -R archipelago:archipelago /home/archipelago/.config
 chown -R archipelago:archipelago /home/archipelago/.local