fix: auth, container resilience, ISO build, gamepad polish

- fix: login disconnect — verify session before WebSocket connect
- fix: 403 on app install — distinguish CSRF vs RBAC errors, only retry CSRF
- fix: health monitor now watches ALL containers (removed skip list for
  backend services like nbxplorer, databases, UI containers)
- fix: server.get-state added to CSRF-exempt list (read-only)
- fix: ISO build includes container-specs.sh and lib/common.sh in rootfs
  so reconcile actually works on fresh installs
- fix: gamepad nav — improved Server tab zone nav, focus styles, autofocus
- chore: move L484 web-only apps to Services tab
- chore: install store for cross-view install tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/views/discover/FeaturedApps.vue

@@ -13,7 +13,7 @@
         data-controller-container
         tabindex="0"
         role="link"
-        class="discover-featured-card glass-card p-6 cursor-pointer"
+        class="glass-card p-6 transition-all hover:-translate-y-1 cursor-pointer"
         :class="{ 'card-stagger': showStagger }"
         :style="{ '--stagger-index': index }"
         @click="$emit('view-details', app)"