fix: implement 22 security pentest remediation fixes

Server-side session management with SHA-256 hashed tokens and HttpOnly
cookies. Auth middleware gating all RPC/WS/proxy routes with method
allowlist. Login rate limiting (5/60s per IP). CORS restricted to
config origin. Docker registry allowlist. App ID and path validation.
P2P message sanitization (HTML + log injection). Onion address and
known-peer validation. Nginx security headers (CSP, X-Frame-Options,
etc.) and AIUI proxy auth. Systemd hardening (non-root, NoNewPrivileges,
ProtectSystem).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/archipelago.service

@@ -5,9 +5,9 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-User=root
+User=archipelago
 Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"
-Environment="ARCHIPELAGO_DEV_MODE=true"
+Environment="ARCHIPELAGO_DEV_MODE=false"
 # Host IP for container env vars (FM_P2P_URL, etc.) - detected at startup if unset
 EnvironmentFile=-/etc/archipelago/host-ip.env
 ExecStartPre=/bin/bash -c 'mkdir -p /etc/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk \"{print \\$1}\")" > /etc/archipelago/host-ip.env'
@@ -15,5 +15,12 @@ ExecStart=/usr/local/bin/archipelago
 Restart=on-failure
 RestartSec=5
 
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/archipelago
+ProtectHome=true
+PrivateTmp=true
+
 [Install]
 WantedBy=multi-user.target