feat(oci): run official container images as native LXC containers

Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.

Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.

Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
  which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
  that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
  instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources

Audit & Report:
- findings that moved in the wrong direction between runs are reported
  alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
  do next

Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
  instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes

The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

AppImage/messages/sk/common.json

@@ -5208,6 +5208,9 @@
     "noFindings": "Aktuálnemu filtru nezodpovedajú žiadne zistenia.",
     "affectedCount": "ovplyvnené: {count}",
     "acceptedNotice": "Na tomto serveri je zaznamenaných {count} prijatých rizík.",
+    "reviewOn": "Skontrolovať dňa: {when}",
+    "reviewDue": "Čaká na kontrolu — rozhodnutie stále platí",
+    "reviewDueNotice": "{count} prijaté rozhodnutie/a čaká na kontrolu.",
     "states": {
       "fail": "Zlyhalo",
       "warn": "Upozornenie",
@@ -5228,6 +5231,8 @@
     },
     "detail": {
       "why": "Súvislosti",
+      "whatItMeans": "Čo to znamená",
+      "whatToDo": "Čo urobiť",
       "evidence": "Podklady",
       "affected": "Ovplyvnené",
       "acceptedRisk": "Prijaté riziko",
@@ -5683,6 +5688,9 @@
       "expiryLabel": "Znova preveriť po",
       "expiryHelp": "Po uplynutí obdobia bude zistenie opäť aktívne.",
       "expiryNever": "Bez vypršania",
+      "reviewLabel": "Pripomenúť kontrolu",
+      "reviewHelp": "Rozhodnutie stále platí; iba sa znova dostane do pozornosti.",
+      "reviewNever": "Bez pripomienky",
       "expiry90": "90 dní",
       "expiry180": "180 dní",
       "expiry365": "1 rok",
@@ -6085,6 +6093,10 @@
       "unchanged": "{count} kontrol dalo rovnaký výsledok ako predtým.",
       "new": "Nové",
       "newNote": "hlásené teraz a predtým nie",
+      "worse": "Zhoršené",
+      "worseNote": "stále sa hlásia a sú závažnejšie alebo majú väčší rozsah než predtým",
+      "better": "Zlepšené",
+      "betterNote": "stále sa hlásia, ale sú menej závažné alebo majú menší rozsah než predtým",
       "resolved": "Vyriešené",
       "resolvedNote": "už sa nehlásia a nikto ich neprijal",
       "accepted": "Prijaté",