fix(apps): persist btcpay plugins and wire the internal LND node

Two btcpay-server manifest gaps found on shorty-s (2026-07-10):

- BTCPAY_PLUGINDIR=/datadir/Plugins: the image default is container-local,
  so every container recreate silently wiped installed plugins (the
  reinstall-the-nostr-plugin-after-every-restart symptom, plus a soft-restart
  loop while an install was pending).
- BTCPAY_BTCLIGHTNING via optional secret_env btcpay-lnd-connection: the
  manifest never wired the internal LND node. The secret is generated by the
  daemon (see previous commit); nodes without LND skip it.

releases/app-catalog.json regenerated (embeds the manifest; origin-wins
overlay means nodes only pick this up from the published catalog). Signature
stripped by regeneration — run scripts/sign-catalog.sh before publishing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/btcpay-server/manifest.yml

@@ -13,6 +13,12 @@ app:
         secret_file: bitcoin-rpc-password
       - key: BTCPAY_DB_PASS
         secret_file: btcpay-db-password
+      # Internal LND node. Generated by the daemon (lnd macaroon as hex +
+      # tls.cert thumbprint) — see container::lnd::ensure_btcpay_lnd_connection_secret.
+      # Optional: nodes without LND run btcpay without an internal node.
+      - key: BTCPAY_BTCLIGHTNING
+        secret_file: btcpay-lnd-connection
+        optional: true
     derived_env:
       - key: BTCPAY_HOST
         template: "{{HOST_IP}}:23000"
@@ -50,6 +56,10 @@ app:
     - ASPNETCORE_URLS=http://0.0.0.0:49392
     - BTCPAY_PROTOCOL=http
     - BTCPAY_CHAINS=btc
+    # Plugins must live on the persistent volume: the image default
+    # (/root/.btcpayserver/Plugins) is container-local, so every recreate
+    # silently wiped installed plugins.
+    - BTCPAY_PLUGINDIR=/datadir/Plugins
     - BTCPAY_BTCEXPLORERURL=http://archy-nbxplorer:32838
     - BTCPAY_BTCRPCURL=http://bitcoin-knots:8332
     - BTCPAY_BTCRPCUSER=archipelago