feat(oci): run official container images as native LXC containers

Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.

Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.

Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
  which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
  that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
  instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources

Audit & Report:
- findings that moved in the wrong direction between runs are reported
  alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
  do next

Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
  instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes

The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/messages/en/docs/monitor/health-monitor.json

@@ -289,7 +289,7 @@
   },
   "rest": {
     "heading": "REST endpoints",
-    "intro": "Everything the modal does is callable from the API — handy for scripts, custom dashboards or your own chat-bot integration.",
+    "intro": "Everything the modal does is callable from the API — handy for scripts, custom dashboards or your own chat-bot integration. Every call needs an API token; calls that change something — dismissing an alert, saving the suppression settings, cleaning up orphans — require one with full_admin scope, and a read_only token receives 403.",
     "headerEndpoint": "Endpoint",
     "headerMethod": "Method",
     "headerUse": "Use",

web/messages/es/docs/monitor/health-monitor.json

@@ -289,7 +289,7 @@
   },
   "rest": {
     "heading": "Endpoints REST",
-    "intro": "Todo lo que hace el modal se puede llamar desde la API — útil para scripts, paneles propios o tu propia integración de chat-bot.",
+    "intro": "Todo lo que hace el modal se puede llamar desde la API — útil para scripts, paneles propios o tu propia integración de chat-bot. Cada llamada necesita un token de API; las que modifican algo — descartar una alerta, guardar los ajustes de supresión o limpiar huérfanos — requieren uno con scope full_admin, y un token read_only recibe 403.",
     "headerEndpoint": "Endpoint",
     "headerMethod": "Método",
     "headerUse": "Uso",

web/package.json

@@ -3,10 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "scripts": {
-    "sync:scripts": "rm -rf public/scripts && rsync -a ../scripts/ public/scripts/",
-    "predev": "npm run sync:scripts",
     "dev": "next dev",
-    "prebuild": "npm run sync:scripts",
     "build": "next build && pagefind --site out --output-path public/pagefind && cp -r public/pagefind out/pagefind",
     "start": "next start",
     "lint": "next lint",