Merge ngit external-access PR 79ca68c1 into combined UAT candidate

Preserve current maintenance/session guards, Firewall UI and existing catalogs.
Retain scoped guest access, publishing journeys and local Blossom integration.
Normalize Blossom/router memory units to supported quadlet suffixes.

Validation: 108 dashboard tests, 10 gateway policy tests, strict source catalog
check. Integrated isolated backend qualification remains required before main.

scripts/test-backend-isolated.sh

@@ -11,6 +11,7 @@ metadata=$(mktemp)
 trap 'rm -f "$metadata"' EXIT
 case "${ARCHY_TEST_PACKAGE:-archipelago}" in
   archipelago) test_target=(-p archipelago --bin archipelago) ;;
+  archipelago-publishing-tests) test_target=(-p archipelago-publishing-tests --lib) ;;
   archipelago-container) test_target=(-p archipelago-container --lib) ;;
   *) echo 'Unsupported isolated test package' >&2; exit 2 ;;
 esac