feat(oci): run official container images as native LXC containers

Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.

Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.

Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
  which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
  that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
  instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources

Audit & Report:
- findings that moved in the wrong direction between runs are reported
  alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
  do next

Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
  instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes

The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

AppImage/components/audit-comparison.tsx

@@ -4,8 +4,8 @@ import { useCallback, useEffect, useState } from "react"
 import { Badge } from "./ui/badge"
 import { Button } from "./ui/button"
 import {
-  ChevronDown, ChevronRight, Flag, Loader2, MinusCircle,
-  PlusCircle, ShieldOff, TrendingUp,
+  ArrowDownRight, ArrowUpRight, ChevronDown, ChevronRight, Flag, Loader2,
+  MinusCircle, PlusCircle, ShieldOff, TrendingUp,
 } from "lucide-react"
 import { fetchApi } from "../lib/api-config"
 import { useT, useI18n } from "../lib/i18n/provider"
@@ -24,6 +24,12 @@ import { useT, useI18n } from "../lib/i18n/provider"
  * only the first is progress, and merging them would tell the reader a
  * problem went away when the decision was to live with it.
  *
+ * The same care applies to a finding that is still reported. One that
+ * was already failing has not appeared now, so it is shown as having got
+ * worse or better with where it came from, rather than as new — reading
+ * "new" against work that lowered a critical to a warning would punish
+ * exactly the reader who fixed something.
+ *
  * It sits inside the assessment rather than in a view of its own,
  * because "what changed since last time" is context for the run being
  * read, not a separate place to visit.
@@ -33,12 +39,18 @@ interface Finding {
   check_id: string
   area: string
   classification: string
+  // Only the findings that moved carry where they came from.
+  previous_classification?: string
+  previous_affected?: number
+  affected_count?: number
 }
 
 interface Comparison {
   from: string
   to: string
   new: Finding[]
+  worse: Finding[]
+  better: Finding[]
   resolved: Finding[]
   accepted: Finding[]
   unchanged: Finding[]
@@ -46,8 +58,23 @@ interface Comparison {
   unverified: Finding[]
 }
 
+/** What moved, in the reader's terms: the gravity when that is what
+ *  changed, otherwise how many objects the finding now covers. */
+function movement(f: Finding, t: (k: string) => string): string | null {
+  if (!f.previous_classification) return null
+  if (f.previous_classification !== f.classification) {
+    return `${t(`audit.classifications.${f.previous_classification}`)} → ${t(
+      `audit.classifications.${f.classification}`,
+    )}`
+  }
+  if (f.previous_affected === undefined || f.affected_count === undefined) return null
+  return `${f.previous_affected} → ${f.affected_count}`
+}
+
 const GROUPS = [
   { key: "new", Icon: PlusCircle, tone: "text-amber-500" },
+  { key: "worse", Icon: ArrowUpRight, tone: "text-red-400" },
+  { key: "better", Icon: ArrowDownRight, tone: "text-emerald-400" },
   { key: "resolved", Icon: MinusCircle, tone: "text-green-500" },
   { key: "accepted", Icon: ShieldOff, tone: "text-indigo-400" },
   { key: "retired", Icon: Flag, tone: "text-muted-foreground" },
@@ -199,11 +226,19 @@ export function AuditComparison({ runId, isBaseline, onBaselineSet }: {
                       </span>
                     </p>
                     <div className="flex flex-wrap gap-1.5">
-                      {(comparison[key] || []).map((f) => (
-                        <Badge key={f.check_id} variant="outline" className="text-xs">
-                          {t(`audit.checks.${f.check_id}.title`)}
-                        </Badge>
-                      ))}
+                      {(comparison[key] || []).map((f) => {
+                        const moved = movement(f, t)
+                        return (
+                          <Badge key={f.check_id} variant="outline" className="text-xs">
+                            {t(`audit.checks.${f.check_id}.title`)}
+                            {moved && (
+                              <span className="ml-1.5 font-normal text-muted-foreground tabular-nums">
+                                {moved}
+                              </span>
+                            )}
+                          </Badge>
+                        )
+                      })}
                     </div>
                   </div>
                 ),