ProxMenux 1.2.6.2-beta: OCI containers in the Monitor, docs and fixes

OCI manager Apps
- App tab: containers installed from an OCI image are identified from their
  installation record; the application and image versions are shown and an
  update is detected by image digest; repository link; Refresh data.
- Updates tab for OCI containers: Update and Recreate run the same flow as the
  OCI menu in the Monitor terminal; the pre-update backup can be kept in a
  backup storage; scheduled image updates with an optional minimum age.
- Logs tab: console output of the application, kept on the host
  (lxc.console.logfile + logrotate) and followed live.
- The Proxmox console opens a shell (cmode: shell) when the image has one.
- A damaged image download is fetched again before failing.
- Multi-container applications open at their LAN address; volume mount
  points on block storage report their usage.

Monitor
- Proxmox notifications are delivered to a loopback-only HTTP listener when
  HTTPS is enabled, so they no longer fail certificate verification.
- Log persistence counts recurring patterns only; an ended burst is not
  reported as persistent and its warning clears on its own (#386).
- Proxmox notification config backups are deduplicated and capped at three.
- The update icon on the Apps page opens the container on its Updates tab.
- Version 1.2.6.2-beta and its release notes in every Monitor language.

Docs
- OCI manager Apps and Audit & Report rebuilt as per-page message files,
  with a new page for OCI containers in the Monitor.
- Seven pages fixed where rich-text tags were missing from t.rich.

Translations
- Spanish fixes across the OCI engine, the Monitor and the TUI menus.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

oci/remote/oci_instance_transaction.py

@@ -40,7 +40,10 @@ BASIC = {'arch', 'cmode', 'console', 'tty', 'cores', 'cpulimit', 'cpuunits', 'de
          'entrypoint', 'env', 'features', 'hostname', 'memory', 'net0', 'onboot',
          'ostype', 'rootfs', 'swap', 'tags', 'unprivileged',
          'lxc.init.cwd', 'lxc.init.uid', 'lxc.init.gid', 'lxc.init.groups',
-         'lxc.signal.halt', 'lxc.environment.runtime'}
+         'lxc.signal.halt', 'lxc.environment.runtime',
+         # The container's console log, set by the installer on every
+         # creation; the rebuilt container gets it again the same way.
+         'lxc.console.logfile'}
 # Their output is data (and may hold saved secrets); it is never logged.
 DATA_COMMANDS = {('pct', 'config'), ('pvesh', 'get')}
 LOG_DIR = Path(os.environ.get('OCI_LOG_DIR', '/var/log/proxmenux/oci'))
@@ -759,7 +762,8 @@ def check_archive(archive):
 
 
 def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, interrupt_after=None,
-          backup_compression='zstd', acknowledge_external_data=False, coordinated=None, progress=None):
+          backup_compression='zstd', acknowledge_external_data=False, coordinated=None, progress=None,
+          keep_backup=None):
     # A coordinated member is shown by its stack; progress prefixes the installer steps.
     show = not coordinated
     update = operation == 'update'
@@ -944,6 +948,11 @@ def apply(root, vmid, archive, operation, proposal=None, registry_digest=None, i
     freed = 0
     try:
         release_stage(state)
+        if keep_backup and state.get('backup'):
+            import oci_keep_backup
+            kept = oci_keep_backup.keep(state['backup'], keep_backup)
+            if kept:
+                msg_ok(f"{translate('Backup kept in')} {keep_backup}: {Path(kept).name}")
         prune_backups(root, vmid)
         for path, size in image_cache.prune(root, lock=False):
             log(f'removed unused image archive: {path}')