feat(oci): run official container images as native LXC containers

Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.

Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.

Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
  which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
  that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
  instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources

Audit & Report:
- findings that moved in the wrong direction between runs are reported
  alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
  do next

Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
  instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes

The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

oci/catalog/generation-report.json

@@ -0,0 +1,206 @@
+{
+  "generated": [
+    "adguardhome-sync",
+    "airsonic-advanced",
+    "altus",
+    "apprise-api",
+    "ardour",
+    "audacity",
+    "azahar",
+    "babybuddy",
+    "bambustudio",
+    "bazarr",
+    "beets",
+    "bitcoin-knots",
+    "blade-of-agony",
+    "blender",
+    "boinc",
+    "bookstack",
+    "brave",
+    "budge",
+    "calibre",
+    "calibre-web",
+    "calligra",
+    "changedetection.io",
+    "chrome",
+    "chromium",
+    "code-server",
+    "cops",
+    "cura",
+    "darktable",
+    "davos",
+    "ddclient",
+    "deluge",
+    "digikam",
+    "diskover",
+    "dogwalk",
+    "dokuwiki",
+    "dolphin",
+    "doplarr",
+    "doplarr_rs",
+    "dosbox-staging",
+    "doublecommander",
+    "duckdns",
+    "duckstation",
+    "duplicati",
+    "eden",
+    "emby",
+    "fail2ban",
+    "faster-whisper",
+    "ferdium",
+    "filezilla",
+    "firefox",
+    "flexget",
+    "flycast",
+    "foldingathome",
+    "freecad",
+    "freshrss",
+    "gimp",
+    "github-desktop",
+    "gitqlient",
+    "grav",
+    "grocy",
+    "gzdoom",
+    "habridge",
+    "handbrake",
+    "healthchecks",
+    "hedgedoc",
+    "heimdall",
+    "helium",
+    "hishtory-server",
+    "homeassistant",
+    "htpcmanager",
+    "inkscape",
+    "intellij-idea",
+    "jackett",
+    "jellyfin",
+    "joplin",
+    "kali-linux",
+    "kasm",
+    "kavita",
+    "kdenlive",
+    "keepassxc",
+    "kicad",
+    "kimai",
+    "kometa",
+    "krita",
+    "lazylibrarian",
+    "ldap-auth",
+    "libreoffice",
+    "librespeed",
+    "librewolf",
+    "lidarr",
+    "limnoria",
+    "lm-studio",
+    "lollypop",
+    "luanti",
+    "lychee",
+    "mame",
+    "manyfold",
+    "mariadb",
+    "mastodon",
+    "mediaelch",
+    "medusa",
+    "melonds",
+    "minisatip",
+    "monica",
+    "msedge",
+    "mstream",
+    "mullvad-browser",
+    "mylar3",
+    "mysql-workbench",
+    "netbox",
+    "nextcloud",
+    "nginx",
+    "ngircd",
+    "nzbget",
+    "nzbhydra2",
+    "obsidian",
+    "ombi",
+    "onlyoffice",
+    "openshot",
+    "openssh-server",
+    "openvscode-server",
+    "opera",
+    "orcaslicer",
+    "oscam",
+    "pairdrop",
+    "pcsx2",
+    "pelorus",
+    "phpmyadmin",
+    "pidgin",
+    "piper",
+    "piwigo",
+    "planka",
+    "plex",
+    "ppsspp",
+    "projectsend",
+    "prowlarr",
+    "pwndrop",
+    "pycharm",
+    "pydio-cells",
+    "pyload-ng",
+    "qbittorrent",
+    "qdirstat",
+    "radarr",
+    "raneto",
+    "rawtherapee",
+    "remmina",
+    "resilio-sync",
+    "retroarch",
+    "rpcs3",
+    "rsnapshot",
+    "rustdesk",
+    "sabnzbd",
+    "scummvm",
+    "sealskin",
+    "shadps4",
+    "shotcut",
+    "sickgear",
+    "signal",
+    "smokeping",
+    "sonarr",
+    "speedtest-tracker",
+    "spotube",
+    "sqlitebrowser",
+    "steam",
+    "swag",
+    "synclounge",
+    "syncthing",
+    "syslog-ng",
+    "tautulli",
+    "telegram",
+    "thelounge",
+    "thunderbird",
+    "transmission",
+    "tvheadend",
+    "ubooquity",
+    "ungoogled-chromium",
+    "unifi-network-application",
+    "vivaldi",
+    "vlc",
+    "vscode",
+    "vscodium",
+    "vscodium-web",
+    "webcord",
+    "webgrabplus",
+    "webstation",
+    "webtop",
+    "weixin",
+    "wikijs",
+    "winegui",
+    "wireguard",
+    "wireshark",
+    "wps-office",
+    "xbackbone",
+    "xemu",
+    "yaak",
+    "your_spotify",
+    "zen",
+    "znc",
+    "zotero"
+  ],
+  "generated_count": 199,
+  "failed": [],
+  "failed_count": 0
+}