feat: architecture review fixes, self-update system, CI pipeline, supply chain hardening

Architecture review (all P0+P1 issues now fixed):
- Add 10s timeout to 6 bare Nostr client.connect() calls
- Pin all 12 crypto deps to exact versions from Cargo.lock
- Pin all 15 floating container image tags to exact patch versions
- Add CI pipeline (cargo fmt + clippy + tests, frontend type-check + build)

Self-update system (git.tx1138.com):
- scripts/self-update.sh: pull, build, install, restart with rollback
- systemd timer checks daily at 3 AM
- update.check RPC does git-based checks when repo is present
- update.git-apply RPC triggers self-update from UI
- Default update URL changed from GitHub to git.tx1138.com
- Git added to ISO package list for fresh installs

Documentation:
- CHANGELOG v1.3.1 with all changes
- README updated (version, update system section)
- BETA-PROGRESS session #6 logged
- architecture-review.html: 4 issues marked FIXED, 8/12 refactoring done

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -219,6 +219,7 @@ RUN apt-get update && apt-get install -y \
     tor \
     curl \
     wget \
+    git \
     htop \
     vim-tiny \
     ca-certificates \
@@ -273,6 +274,8 @@ RUN mkdir -p /etc/archipelago/ssl && \
 
 # Create archipelago systemd service
 COPY archipelago.service /etc/systemd/system/archipelago.service
+COPY archipelago-update.service /etc/systemd/system/archipelago-update.service
+COPY archipelago-update.timer /etc/systemd/system/archipelago-update.timer
 
 # Enable services
 RUN systemctl enable NetworkManager || true && \
@@ -281,7 +284,8 @@ RUN systemctl enable NetworkManager || true && \
     systemctl enable archipelago || true && \
     systemctl enable tor || true && \
     systemctl enable tailscaled || true && \
-    systemctl enable chrony || true
+    systemctl enable chrony || true && \
+    systemctl enable archipelago-update.timer || true
 
 # Remove policy-rc.d so services can start on first boot
 RUN rm -f /usr/sbin/policy-rc.d
@@ -334,6 +338,13 @@ NGINXCONF
         echo "   Using 99-mesh-radio.rules from configs/"
     fi
 
+    # Copy update service and timer
+    if [ -f "$SCRIPT_DIR/configs/archipelago-update.service" ]; then
+        cp "$SCRIPT_DIR/configs/archipelago-update.service" "$WORK_DIR/archipelago-update.service"
+        cp "$SCRIPT_DIR/configs/archipelago-update.timer" "$WORK_DIR/archipelago-update.timer"
+        echo "   Using archipelago-update.service + timer from configs/"
+    fi
+
     # Use archipelago.service from configs/ (User=root for Podman container access)
     if [ -f "$SCRIPT_DIR/configs/archipelago.service" ]; then
         cp "$SCRIPT_DIR/configs/archipelago.service" "$WORK_DIR/archipelago.service"
@@ -892,6 +903,17 @@ if [ -f "$SCRIPT_DIR/../scripts/run-e2e-tests.sh" ]; then
     echo "   ✅ Bundled E2E test script for post-install validation"
 fi
 
+# Bundle self-update script and image-versions for update system
+if [ -f "$SCRIPT_DIR/../scripts/self-update.sh" ]; then
+    cp "$SCRIPT_DIR/../scripts/self-update.sh" "$ARCH_DIR/scripts/"
+    chmod +x "$ARCH_DIR/scripts/self-update.sh"
+    echo "   ✅ Bundled self-update script"
+fi
+if [ -f "$SCRIPT_DIR/../scripts/image-versions.sh" ]; then
+    cp "$SCRIPT_DIR/../scripts/image-versions.sh" "$ARCH_DIR/scripts/"
+    echo "   ✅ Bundled image-versions.sh"
+fi
+
 # Bundle docker UI source files for building custom UIs on first boot (fallback if images not captured)
 # Skip for unbundled builds
 if [ "$UNBUNDLED" != "1" ]; then
@@ -1206,6 +1228,35 @@ if [ -f "$BOOT_MEDIA/archipelago/scripts/run-e2e-tests.sh" ]; then
     chmod +x /mnt/target/opt/archipelago/scripts/run-e2e-tests.sh
 fi
 
+# Copy self-update script
+if [ -f "$BOOT_MEDIA/archipelago/scripts/self-update.sh" ]; then
+    cp "$BOOT_MEDIA/archipelago/scripts/self-update.sh" /mnt/target/opt/archipelago/scripts/
+    chmod +x /mnt/target/opt/archipelago/scripts/self-update.sh
+    # Also place in home for the update timer to find
+    mkdir -p /mnt/target/home/archipelago/archy/scripts
+    cp "$BOOT_MEDIA/archipelago/scripts/self-update.sh" /mnt/target/home/archipelago/archy/scripts/
+    chmod +x /mnt/target/home/archipelago/archy/scripts/self-update.sh
+fi
+
+# Clone repo for git-based updates (first-boot will have network)
+# Create a script that runs on first boot to clone the repo
+cat > /mnt/target/opt/archipelago/scripts/setup-git-updates.sh <<'GITSETUP'
+#!/bin/bash
+# Clone the Archipelago repo for git-based self-updates
+REPO_DIR="/home/archipelago/archy"
+if [ -d "$REPO_DIR/.git" ]; then
+    exit 0  # Already cloned
+fi
+echo "[update] Cloning Archipelago repo for self-updates..."
+su - archipelago -c "git clone https://git.tx1138.com/lfg2025/archy $REPO_DIR" 2>/dev/null || {
+    echo "[update] Git clone failed (network?). Updates will retry on next boot."
+    exit 0
+}
+chown -R 1000:1000 "$REPO_DIR"
+echo "[update] Repo cloned. Self-updates enabled."
+GITSETUP
+chmod +x /mnt/target/opt/archipelago/scripts/setup-git-updates.sh
+
 # Ensure correct ownership (use numeric UID:GID 1000:1000 since we're outside chroot)
 chown -R 1000:1000 /mnt/target/opt/archipelago 2>/dev/null || true
 chown -R 1000:1000 /mnt/target/var/lib/archipelago 2>/dev/null || true