feat(oci): run official container images as native LXC containers

Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.

Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.

Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
  which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
  that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
  instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources

Audit & Report:
- findings that moved in the wrong direction between runs are reported
  alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
  do next

Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
  instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes

The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

oci/catalog/generation-report-imported.json

@@ -0,0 +1,158 @@
+{
+  "generated": [
+    "2fauth",
+    "actualbudget",
+    "adguard-home",
+    "adminer",
+    "albyhub",
+    "alist",
+    "alist-sync",
+    "anaconda3",
+    "anythingllm",
+    "archivebox",
+    "audiobookshelf",
+    "autobrr",
+    "beaverhabittracker",
+    "bentopdf",
+    "blinko",
+    "chatbot-ui",
+    "chatgpt-next-web",
+    "cloudbeaver",
+    "cloudflared",
+    "clumoove",
+    "convertx",
+    "copyparty",
+    "crafty",
+    "databag",
+    "ddns-go",
+    "ddns-updater",
+    "deepseek-ocr-nvidia",
+    "dify",
+    "docmost",
+    "downtify",
+    "dsh-harness",
+    "emby-nvidia",
+    "emby-vaapi",
+    "embystat",
+    "emulatorjs",
+    "esphome",
+    "etherpad",
+    "excalidraw",
+    "filedrop",
+    "fileflows-vaapi",
+    "firefly",
+    "flaresolverr",
+    "flowise",
+    "freshrss-official",
+    "gateway-go",
+    "gitea",
+    "glances",
+    "gopeed",
+    "grafana",
+    "handbrake-jlesage",
+    "hermes",
+    "holoplay",
+    "homeassistant-official",
+    "homebridge",
+    "hugo",
+    "index-tts",
+    "index-tts-nvidia",
+    "jellyfin-nvidia",
+    "jellyfin-vaapi",
+    "jellyseerr",
+    "jenkins",
+    "karakeep",
+    "kavita-jvmilazz0",
+    "komga",
+    "label-studio",
+    "langflow",
+    "librechat",
+    "libredb-studio",
+    "linkwarden",
+    "llama-factory-nvidia",
+    "llamacpp-vaapi",
+    "logseq",
+    "lucky",
+    "lyrionmusicserver",
+    "maybe",
+    "medusa-official",
+    "memos",
+    "mineos-node",
+    "mongodb",
+    "mongodb4",
+    "monica-official",
+    "motioneye",
+    "myspeed",
+    "n8n",
+    "navidrome",
+    "netbird",
+    "netdata",
+    "netronome",
+    "nextcloud-official",
+    "nginxproxymanager",
+    "node-red",
+    "nzbfast",
+    "ollama",
+    "ollama-nvidia",
+    "open-webui-ollama-nvidia",
+    "openclaw",
+    "openhab",
+    "openhands",
+    "openlist",
+    "openspeedtest",
+    "opodsync",
+    "overseerr",
+    "pdfding",
+    "peanut",
+    "petio",
+    "photoprism",
+    "pihole",
+    "pinchflat",
+    "pingvin-share",
+    "playit-agent",
+    "plex-nvidia",
+    "plex-vaapi",
+    "pocketbase",
+    "podfetch",
+    "portainer",
+    "postgresql",
+    "psitransfer",
+    "qbittorrent-hotio",
+    "qui",
+    "ragflow",
+    "rdtclient",
+    "readarr",
+    "retroarch-inglebard",
+    "romm",
+    "roonserver-vaapi",
+    "sickchill",
+    "siyuan-note",
+    "snapdrop",
+    "snapotter",
+    "stable-diffusion-webui-nvidia",
+    "stremio-vaapi",
+    "sure",
+    "swingmusic",
+    "tailscale",
+    "taskingai",
+    "teable",
+    "threadfin",
+    "trilium",
+    "turbodiffusion-nvidia",
+    "twingate-connector",
+    "unifi-controller",
+    "uptimekuma",
+    "v2raya",
+    "vaultwarden",
+    "virt-manager",
+    "vocechat",
+    "wallabag",
+    "webdav",
+    "weknora",
+    "wg-easy",
+    "ztnet"
+  ],
+  "generated_count": 151,
+  "failed": [],
+  "failed_count": 0
+}