ProxMenux 1.2.6.2-beta: OCI containers in the Monitor, docs and fixes

OCI manager Apps
- App tab: containers installed from an OCI image are identified from their
  installation record; the application and image versions are shown and an
  update is detected by image digest; repository link; Refresh data.
- Updates tab for OCI containers: Update and Recreate run the same flow as the
  OCI menu in the Monitor terminal; the pre-update backup can be kept in a
  backup storage; scheduled image updates with an optional minimum age.
- Logs tab: console output of the application, kept on the host
  (lxc.console.logfile + logrotate) and followed live.
- The Proxmox console opens a shell (cmode: shell) when the image has one.
- A damaged image download is fetched again before failing.
- Multi-container applications open at their LAN address; volume mount
  points on block storage report their usage.

Monitor
- Proxmox notifications are delivered to a loopback-only HTTP listener when
  HTTPS is enabled, so they no longer fail certificate verification.
- Log persistence counts recurring patterns only; an ended burst is not
  reported as persistent and its warning clears on its own (#386).
- Proxmox notification config backups are deduplicated and capped at three.
- The update icon on the Apps page opens the container on its Updates tab.
- Version 1.2.6.2-beta and its release notes in every Monitor language.

Docs
- OCI manager Apps and Audit & Report rebuilt as per-page message files,
  with a new page for OCI containers in the Monitor.
- Seven pages fixed where rich-text tags were missing from t.rich.

Translations
- Spanish fixes across the OCI engine, the Monitor and the TUI menus.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

oci/remote/install_tandoor_stack.sh

@@ -261,7 +261,7 @@ resolve_image_manifest() {
 
 ensure_image() {
   local key=$1 image=$2 transport_image inspect digest short archive_name archive_volume archive_path
-  local partial log pid bytes elapsed status
+  local partial log pid bytes elapsed status attempt
   msg_info "$(translate "Checking the image in the registry...")"
   oci_log "Resolving ${key}: ${image}"
   transport_image=$(skopeo_transport_reference "$image")
@@ -282,29 +282,44 @@ ensure_image() {
     oci_log "Reusing ${archive_volume}"
   else
     rm -f "$archive_path"
-    partial="${archive_path}.partial.$$"
-    log="${partial}.log"
-    oci_log "Downloading ${image} by digest ${digest}"
-    skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
-      --retry-delay 5s --image-parallel-copies 1 \
-      "docker://${transport_image}" "oci-archive:${partial}:image-tandoor-${key}" >"$log" 2>&1 &
-    pid=$!
-    elapsed=0
-    while kill -0 "$pid" 2>/dev/null; do
-      bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
-      msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
-      sleep 2
-      elapsed=$((elapsed + 2))
+    # A download can come back complete yet damaged when the connection drops
+    # and the transfer resumes; the integrity check catches it, and a second
+    # download is what repairs it.
+    for attempt in 1 2; do
+      partial="${archive_path}.partial.$$"
+      log="${partial}.log"
+      oci_log "Downloading ${image} by digest ${digest} (attempt ${attempt}/2)"
+      skopeo copy --override-os linux --override-arch "$ARCH" --retry-times 3 \
+        --retry-delay 5s --image-parallel-copies 1 \
+        "docker://${transport_image}" "oci-archive:${partial}:image-tandoor-${key}" >"$log" 2>&1 &
+      pid=$!
+      elapsed=0
+      while kill -0 "$pid" 2>/dev/null; do
+        bytes=$(stat -c %s "$partial" 2>/dev/null || printf 0)
+        msg_progress "$(translate "Downloading the image:") ${key} · $((bytes / 1048576)) MiB · ${elapsed}s"
+        sleep 2
+        elapsed=$((elapsed + 2))
+      done
+      status=0
+      wait "$pid" || status=$?
+      cat "$log" >>"$OCI_LOG"
+      rm -f "$log"
+      if (( status != 0 )); then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "Image download failed:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      msg_info "$(translate "Verifying the image integrity...")"
+      if ! oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial"; then
+        rm -f "$partial"
+        (( attempt < 2 )) || die "$(translate "The downloaded image is corrupt:") $image"
+        msg_warn "$(translate "The image download did not complete correctly; downloading it again...")"
+        continue
+      fi
+      mv -f "$partial" "$archive_path"
+      break
     done
-    status=0
-    wait "$pid" || status=$?
-    cat "$log" >>"$OCI_LOG"
-    rm -f "$log"
-    (( status == 0 )) || { rm -f "$partial"; die "$(translate "Image download failed:") $image"; }
-    msg_info "$(translate "Verifying the image integrity...")"
-    oci_quiet python3 "$VERIFY_OCI_ARCHIVE" "$partial" \
-      || { rm -f "$partial"; die "$(translate "The downloaded image is corrupt:") $image"; }
-    mv -f "$partial" "$archive_path"
   fi
   msg_ok "$(translate "Image:") $image"
   RESOLVED_ARCHIVE=$archive_volume