feat(oci): run official container images as native LXC containers

Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.

Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.

Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
  which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
  that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
  instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources

Audit & Report:
- findings that moved in the wrong direction between runs are reported
  alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
  do next

Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
  instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes

The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/global/update-pve-safe.sh

@@ -80,6 +80,12 @@ update_pve_safe() {
     local start_time
     start_time=$(date +%s)
     local log_file="/var/log/proxmox-update-$(date +%Y%m%d-%H%M%S).log"
+    {
+        echo "=== ProxMenux — Proxmox VE update ==="
+        echo "Started: $(date -Iseconds)"
+        echo "Host:    $(hostname)"
+        echo "Running: $(pveversion 2>/dev/null | head -1)"
+    } > "$log_file"
     # Screen capture: replay the pre-upgrade context lines after `clear`
     # so the operator keeps the visual history around the noisy apt run.
     local screen_capture="/tmp/proxmenux_screen_capture_$$.txt"
@@ -141,6 +147,11 @@ update_pve_safe() {
     local update_output update_exit_code
     update_output=$(apt-get update 2>&1)
     update_exit_code=$?
+    {
+        echo
+        echo "--- apt-get update (exit $update_exit_code) ---"
+        printf '%s\n' "$update_output"
+    } >> "$log_file"
 
     if [ $update_exit_code -eq 0 ]; then
         msg_ok "$(translate "Package lists updated successfully")" | tee -a "$screen_capture"
@@ -163,7 +174,7 @@ update_pve_safe() {
                     apt-key adv --keyserver keyserver.ubuntu.com --recv-keys "$key" >/dev/null 2>&1 || true
                 fi
             fi
-            if apt-get update > "$log_file" 2>&1; then
+            if apt-get update >> "$log_file" 2>&1; then
                 msg_ok "$(translate "Package lists updated after GPG fix")" | tee -a "$screen_capture"
             else
                 msg_error "$(translate "Failed to update package lists. Check log: $log_file")"
@@ -188,10 +199,19 @@ update_pve_safe() {
 
     # ── 5-6. Detect + confirm ──
     local current_pve_version available_pve_version upgradable security_updates
+    local upgradable_raw upgradable_list
     current_pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)
     available_pve_version=$(apt-cache policy pve-manager 2>/dev/null | grep -oP 'Candidate: \K[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-    upgradable=$($APT_ENV apt list --upgradable 2>/dev/null | sed '1d' | sed '/^\s*$/d' | wc -l)
-    security_updates=$($APT_ENV apt list --upgradable 2>/dev/null | sed '1d' | grep -ci '\-security')
+    upgradable_raw=$($APT_ENV apt list --upgradable 2>/dev/null | sed '1d' | sed '/^\s*$/d')
+    upgradable=$(printf '%s' "$upgradable_raw" | grep -c . )
+    security_updates=$(printf '%s\n' "$upgradable_raw" | grep -ci '\-security')
+    upgradable_list=$(printf '%s\n' "$upgradable_raw" | pmx_format_upgradable)
+
+    {
+        echo
+        echo "--- Packages to upgrade ($upgradable) ---"
+        [ "$upgradable" -gt 0 ] && printf '%s\n' "$upgradable_list"
+    } >> "$log_file"
 
     local menu_text
     menu_text="$(translate "System Update Information")\n\n"
@@ -207,12 +227,17 @@ update_pve_safe() {
         whiptail --title "$(translate "Update Status")" --msgbox "$menu_text" 15 70
         apt-get -y autoremove >/dev/null 2>&1 || true
         apt-get -y autoclean >/dev/null 2>&1 || true
+        echo -e "\nSystem is already up to date." >> "$log_file"
         rm -f "$screen_capture"
         return 0
     fi
 
+    # The package list rides in the same dialog as the summary, so the
+    # decision is taken knowing what is about to be replaced. --scrolltext
+    # keeps the buttons reachable however long the list is.
+    menu_text+="$(translate "Packages to be upgraded"):\n$upgradable_list\n\n"
     menu_text+="$(translate "Do you want to proceed with the system update?")"
-    if ! whiptail --title "$(translate "Proxmox Update")" --yesno "$menu_text" 18 70; then
+    if ! whiptail --title "$(translate "Proxmox Update")" --scrolltext --yesno "$menu_text" 24 78; then
         msg_info2 "$(translate "Update cancelled by user")"
         apt-get -y autoremove >/dev/null 2>&1 || true
         apt-get -y autoclean >/dev/null 2>&1 || true
@@ -228,6 +253,12 @@ update_pve_safe() {
     msg_title "$(translate "$SCRIPT_TITLE")"
     cat "$screen_capture"
 
+    # dpkg's log is read back from here on, so the transaction can be
+    # reported package by package without holding apt's output.
+    local dpkg_mark
+    dpkg_mark=$(date '+%Y-%m-%d %H:%M:%S')
+    echo -e "\n--- apt full-upgrade ---" >> "$log_file"
+
     # apt's own progress bar (Progress: [ %]) prints on stderr and only
     # when stdout is a TTY. We pipe stderr through tee to keep a log copy
     # while letting apt keep its interactive stdout, so the native bar
@@ -239,6 +270,12 @@ update_pve_safe() {
     local upgrade_exit_code=$?
     echo -e
 
+    {
+        echo
+        echo "--- Packages changed (exit $upgrade_exit_code) ---"
+        pmx_dpkg_changes_since "$dpkg_mark"
+    } >> "$log_file"
+
     # Redraw once more so the wrap-up (LVM check, cleanup, summary) reads
     # cleanly instead of scrolling under half-a-screen of apt noise.
     clear
@@ -248,6 +285,7 @@ update_pve_safe() {
 
     if [ $upgrade_exit_code -ne 0 ]; then
         msg_error "$(translate "System upgrade failed. Check log: $log_file")"
+        echo "Finished: $(date -Iseconds) — upgrade failed (exit $upgrade_exit_code)" >> "$log_file"
         rm -f "$screen_capture"
         return 1
     fi
@@ -282,6 +320,12 @@ update_pve_safe() {
     echo -e "${TAB}${GN}📦 $(translate "Packages upgraded")${CL}: ${BL}$upgradable${CL}"
     echo -e "${TAB}${GN}🖥️  $(translate "Proxmox VE")${CL}: ${BL}${available_pve_version:-$current_pve_version}${CL}"
 
+    {
+        echo
+        echo "Finished: $(date -Iseconds) — ${minutes}m ${seconds}s"
+        echo "Running: $(pveversion 2>/dev/null | head -1)"
+    } >> "$log_file"
+
     msg_ok "$(translate "Proxmox VE safe update completed")"
     rm -f "$screen_capture"
 }