feat: migrate all container images to Archipelago app registry

All container image references now pull from 80.71.235.15:3000/archipelago/
instead of Docker Hub and ghcr.io. image-versions.sh is the single source
of truth; all scripts use $*_IMAGE variables instead of hardcoded refs.

Files updated:
- scripts/image-versions.sh: central ARCHY_REGISTRY variable
- core/*/config.rs: registry whitelist includes app registry
- core/*/stacks.rs: Immich + Penpot stack images
- scripts/{first-boot,deploy-to-target,container-specs}.sh: use variables
- docker/*/Dockerfile: nginx base image from registry
- image-recipe/: ISO build, podman config, menu script
- scripts/{container-doctor,deploy-bitcoin-knots,fix-indeedhub,validate-app-manifest}.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -620,7 +620,7 @@ if [ "$UNBUNDLED" = "1" ]; then
     IMAGES_DIR="$ARCH_DIR/container-images"
     mkdir -p "$IMAGES_DIR"
     # FileBrowser is a core dependency (powers the Cloud file manager) — always bundle it
-    CORE_IMAGE="${FILEBROWSER_IMAGE:-docker.io/filebrowser/filebrowser:v2}"
+    CORE_IMAGE="${FILEBROWSER_IMAGE}"
     CORE_FILE="filebrowser.tar"
     if [ -f "$IMAGES_DIR/$CORE_FILE" ]; then
         echo "   ✅ Using cached: $CORE_FILE"
@@ -665,34 +665,34 @@ fi
 # bitcoin-ui and lnd-ui are custom and normally captured from server or built separately.
 # Alpha: core Bitcoin/Lightning stack + essential apps. Others pulled on-demand from Marketplace.
 CONTAINER_IMAGES="
-${BITCOIN_KNOTS_IMAGE:-docker.io/bitcoinknots/bitcoin:28.1} bitcoin-knots.tar
-${LND_IMAGE:-docker.io/lightninglabs/lnd:v0.18.5-beta} lnd.tar
-${HOMEASSISTANT_IMAGE:-ghcr.io/home-assistant/home-assistant:2024.12} homeassistant.tar
-${BTCPAY_IMAGE:-docker.io/btcpayserver/btcpayserver:1.13.7} btcpayserver.tar
-${NBXPLORER_IMAGE:-docker.io/nicolasdorier/nbxplorer:2.5.13} nbxplorer.tar
-${POSTGRES_IMAGE:-docker.io/library/postgres:16} postgres-btcpay.tar
-${MEMPOOL_BACKEND_IMAGE:-docker.io/mempool/backend:v3.0.0} mempool-backend.tar
-${MEMPOOL_WEB_IMAGE:-docker.io/mempool/frontend:v3.0.0} mempool-frontend.tar
-${ELECTRUMX_IMAGE:-docker.io/lukechilds/electrumx:v1.16.0} electrumx.tar
-${MARIADB_IMAGE:-docker.io/library/mariadb:11.4} mariadb-mempool.tar
-${FEDIMINT_IMAGE:-docker.io/fedimint/fedimintd:v0.5.1} fedimint.tar
-${FEDIMINT_GATEWAY_IMAGE:-docker.io/fedimint/gatewayd:v0.5.1} fedimint-gateway.tar
-${FILEBROWSER_IMAGE:-docker.io/filebrowser/filebrowser:v2} filebrowser.tar
-${ALPINE_TOR_IMAGE:-docker.io/andrius/alpine-tor:0.4.8.13} alpine-tor.tar
-${NGINX_ALPINE_IMAGE:-docker.io/library/nginx:alpine} nginx-alpine.tar
-${DWN_SERVER_IMAGE:-ghcr.io/tbd54566975/dwn-server:main} dwn-server.tar
-${GRAFANA_IMAGE:-docker.io/grafana/grafana:11.4.0} grafana.tar
-${UPTIME_KUMA_IMAGE:-docker.io/louislam/uptime-kuma:1} uptime-kuma.tar
-${VAULTWARDEN_IMAGE:-docker.io/vaultwarden/server:1.32.5} vaultwarden.tar
-${SEARXNG_IMAGE:-docker.io/searxng/searxng:2026.3.20-6c7e9c197} searxng.tar
-${PORTAINER_IMAGE:-docker.io/portainer/portainer-ce:2.21.5} portainer.tar
-${TAILSCALE_IMAGE:-docker.io/tailscale/tailscale:v1.78.3} tailscale.tar
-${JELLYFIN_IMAGE:-docker.io/jellyfin/jellyfin:10.10.3} jellyfin.tar
-${PHOTOPRISM_IMAGE:-docker.io/photoprism/photoprism:240915} photoprism.tar
-${NEXTCLOUD_IMAGE:-docker.io/library/nextcloud:30} nextcloud.tar
-${NPM_IMAGE:-docker.io/jc21/nginx-proxy-manager:2} nginx-proxy-manager.tar
-${ONLYOFFICE_IMAGE:-docker.io/onlyoffice/documentserver:8.2} onlyoffice.tar
-${ADGUARDHOME_IMAGE:-docker.io/adguard/adguardhome:v0.107.55} adguardhome.tar
+${BITCOIN_KNOTS_IMAGE} bitcoin-knots.tar
+${LND_IMAGE} lnd.tar
+${HOMEASSISTANT_IMAGE} homeassistant.tar
+${BTCPAY_IMAGE} btcpayserver.tar
+${NBXPLORER_IMAGE} nbxplorer.tar
+${POSTGRES_IMAGE} postgres-btcpay.tar
+${MEMPOOL_BACKEND_IMAGE} mempool-backend.tar
+${MEMPOOL_WEB_IMAGE} mempool-frontend.tar
+${ELECTRUMX_IMAGE} electrumx.tar
+${MARIADB_IMAGE} mariadb-mempool.tar
+${FEDIMINT_IMAGE} fedimint.tar
+${FEDIMINT_GATEWAY_IMAGE} fedimint-gateway.tar
+${FILEBROWSER_IMAGE} filebrowser.tar
+${ALPINE_TOR_IMAGE} alpine-tor.tar
+${NGINX_ALPINE_IMAGE} nginx-alpine.tar
+${DWN_SERVER_IMAGE} dwn-server.tar
+${GRAFANA_IMAGE} grafana.tar
+${UPTIME_KUMA_IMAGE} uptime-kuma.tar
+${VAULTWARDEN_IMAGE} vaultwarden.tar
+${SEARXNG_IMAGE} searxng.tar
+${PORTAINER_IMAGE} portainer.tar
+${TAILSCALE_IMAGE} tailscale.tar
+${JELLYFIN_IMAGE} jellyfin.tar
+${PHOTOPRISM_IMAGE} photoprism.tar
+${NEXTCLOUD_IMAGE} nextcloud.tar
+${NPM_IMAGE} nginx-proxy-manager.tar
+${ONLYOFFICE_IMAGE} onlyoffice.tar
+${ADGUARDHOME_IMAGE} adguardhome.tar
 "
 
 # Pull and save each image (force target arch) only if not already present
@@ -871,7 +871,7 @@ else
         sudo $DOCKER run -d --name archy-tor --restart unless-stopped --network host \
             -v "$TOR_DIR:$TOR_DIR" \
             --entrypoint tor \
-            ${ALPINE_TOR_IMAGE:-docker.io/andrius/alpine-tor:0.4.8.13} \
+            ${ALPINE_TOR_IMAGE} \
             -f /etc/tor/torrc >> "$LOG" 2>&1
         echo "$(date): Tor container started" >> "$LOG"
     fi
@@ -922,7 +922,7 @@ if ! $DOCKER ps -a --format '{{.Names}}' 2>/dev/null | grep -q filebrowser; then
         --memory=256m \
         -p 8083:80 \
         -v /var/lib/archipelago/filebrowser:/srv \
-        docker.io/filebrowser/filebrowser:v2 2>>"$LOG" && \
+        "$FILEBROWSER_IMAGE" 2>>"$LOG" && \
         echo "[$(date)] FileBrowser created successfully" >> "$LOG" || \
         echo "[$(date)] WARNING: FileBrowser creation failed" >> "$LOG"
 fi