feat: dynamic app catalog, Gitea app polish, registry sync

App catalog served from Gitea repos (app-catalog) with 35 apps.
Nodes fetch catalog dynamically — new apps appear without frontend
rebuild. Test app added and removed to verify pipeline.

Gitea manifest updated with internal_port/nginx_proxy for iframe.
Updated catalog.json, nginx configs, app session configs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/configs/nginx-gitea-iframe.conf

@@ -0,0 +1,21 @@
+# Gitea iframe proxy — strips X-Frame-Options so Gitea works in Archipelago iframe.
+# Gitea container binds to port 3001, this proxy listens on port 3000 (the public port).
+# Deployed to /etc/nginx/conf.d/gitea-iframe.conf
+server {
+    listen 3000;
+    server_name _;
+    client_max_body_size 1G;
+
+    location / {
+        proxy_pass http://127.0.0.1:3001;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+    }
+}