feat(oci): run official container images as native LXC containers

Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.

Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.

Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
  which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
  that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
  instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources

Audit & Report:
- findings that moved in the wrong direction between runs are reported
  alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
  do next

Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
  instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes

The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

oci/remote/oci_ui.py

@@ -0,0 +1,118 @@
+"""Output helpers for the OCI host helpers written in Python: the look of the
+ProxMenux utils.sh messages and the same translation cache (lang/<language>.json)."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import sys
+import threading
+
+BASE_DIR = Path(os.environ.get("PMX_BASE_DIR", "/usr/local/share/proxmenux"))
+
+MG = "\033[1;35m"
+GN = "\033[1;92m"
+RD = "\033[01;31m"
+YW = "\033[33m"
+YWB = "\033[1;33m"
+BOLD = "\033[1m"
+CL = "\033[m"
+TAB = "    "
+FRAMES = ("⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏")
+
+_language: str | None = None
+_cache: dict[str, str] | None = None
+_spinner: tuple[threading.Thread, threading.Event] | None = None
+
+
+def _load_language() -> str:
+    global _language
+    if _language is None:
+        try:
+            value = json.loads((BASE_DIR / "config.json").read_text(encoding="utf-8")).get("language")
+        except (OSError, ValueError, AttributeError):
+            value = None
+        _language = value if isinstance(value, str) and value else "en"
+    return _language
+
+
+def translate(text: str) -> str:
+    global _cache
+    if _load_language() == "en":
+        return text
+    if _cache is None:
+        try:
+            data = json.loads((BASE_DIR / "lang" / f"{_load_language()}.json").read_text(encoding="utf-8"))
+            _cache = {str(k): str(v) for k, v in data.items()} if isinstance(data, dict) else {}
+        except (OSError, ValueError):
+            _cache = {}
+    return _cache.get(text) or text
+
+
+def _write(text: str) -> None:
+    sys.stdout.write(text)
+    sys.stdout.flush()
+
+
+def _spin(stop: threading.Event) -> None:
+    index = 0
+    _write("\033[?25l")
+    while not stop.wait(0.1):
+        _write(f"\r {MG}{FRAMES[index]}{CL}")
+        index = (index + 1) % len(FRAMES)
+
+
+def stop_spinner() -> None:
+    global _spinner
+    if _spinner is not None:
+        thread, stop = _spinner
+        stop.set()
+        thread.join()
+        _spinner = None
+    _write("\033[?25h")
+
+
+def msg_info(text: str) -> None:
+    global _spinner
+    stop_spinner()
+    _write(f"\r\033[K{TAB}{MG}-{text}{CL}")
+    if sys.stdout.isatty() or os.environ.get("OCI_SPINNER") == "1":
+        stop = threading.Event()
+        thread = threading.Thread(target=_spin, args=(stop,), daemon=True)
+        _spinner = (thread, stop)
+        thread.start()
+    else:
+        _write("\n")
+
+
+def msg_progress(text: str) -> None:
+    stop_spinner()
+    _write(f"\r\033[K{TAB}{MG}-{text}{CL}")
+
+
+def msg_ok(text: str) -> None:
+    stop_spinner()
+    _write(f"\r\033[K{TAB}{GN}✓ {CL}{GN}{text}{CL}\n")
+
+
+def msg_warn(text: str) -> None:
+    stop_spinner()
+    _write(f"\r\033[K{TAB}{CL} {YWB}{text}{CL}\n")
+
+
+def msg_error(text: str) -> None:
+    stop_spinner()
+    _write(f"\r\033[K{TAB}{RD}[ERROR] {text}{CL}\n")
+
+
+def msg_info2(text: str) -> None:
+    stop_spinner()
+    _write(f"\r\033[K{TAB}{BOLD}{YW}- {text}{CL}\n")
+
+
+def log(path: str | os.PathLike | None, text: str) -> None:
+    """Appends a line to a private log; output that the user does not need goes here."""
+    if not path:
+        return
+    with open(path, "a", encoding="utf-8") as handle:
+        handle.write(text.rstrip("\n") + "\n")