feat(oci): run official container images as native LXC containers

Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.

Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.

Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
  which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
  that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
  instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources

Audit & Report:
- findings that moved in the wrong direction between runs are reported
  alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
  do next

Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
  instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes

The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

oci/catalog/overlays/postgresql.json

@@ -0,0 +1,80 @@
+{
+  "container_contract": {
+    "environment": [
+      {
+        "name": "PUID",
+        "example": "$PUID",
+        "required": true,
+        "sensitive": false,
+        "source": "docker-compose"
+      },
+      {
+        "name": "PGID",
+        "example": "$PGID",
+        "required": true,
+        "sensitive": false,
+        "source": "docker-compose"
+      },
+      {
+        "name": "TZ",
+        "example": "$TZ",
+        "required": true,
+        "sensitive": false,
+        "source": "docker-compose"
+      },
+      {
+        "name": "POSTGRES_USER",
+        "example": "postgresql",
+        "required": true,
+        "sensitive": false,
+        "prompt": "Name of the PostgreSQL user created on the first start",
+        "source": "postgres-official-image"
+      },
+      {
+        "name": "POSTGRES_PASSWORD",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "prompt": "Password of the PostgreSQL user",
+        "source": "postgres-official-image"
+      },
+      {
+        "name": "POSTGRES_DB",
+        "example": "postgresql",
+        "required": true,
+        "sensitive": false,
+        "prompt": "Name of the database created on the first start",
+        "source": "postgres-official-image"
+      }
+    ]
+  },
+  "first_run": {
+    "credentials": [
+      {
+        "label": "PostgreSQL",
+        "type": "configured-or-installer-generated",
+        "username": "postgresql",
+        "password": null,
+        "username_environment": "POSTGRES_USER",
+        "password_environment": "POSTGRES_PASSWORD",
+        "change_required": false,
+        "source": "postgres-official-image",
+        "retrieval": null
+      }
+    ]
+  },
+  "proxmox": {
+    "installer_profile": {
+      "generated_sensitive_environment": {
+        "POSTGRES_PASSWORD": {
+          "strategy": "token-hex",
+          "bytes": 16,
+          "prompt": true
+        }
+      },
+      "completion_notes": [
+        "PostgreSQL creates the database named in POSTGRES_DB on the first start. The installer default is postgresql."
+      ]
+    }
+  }
+}