feat(orchestrator): complete container migration and release hardening

scripts/first-boot-containers.sh

@@ -168,6 +168,13 @@ fi
 TARGET_IP=$(hostname -I 2>/dev/null | awk '{print $1}')
 [ -z "$TARGET_IP" ] && TARGET_IP="127.0.0.1"
 
+# Stable mDNS hostname for federation/consensus URLs (survives DHCP / reinstalls).
+# Falls back to $TARGET_IP if avahi is not available.
+HOST_MDNS="$(hostname 2>/dev/null).local"
+if [ -z "$HOST_MDNS" ] || [ "$HOST_MDNS" = ".local" ]; then
+  HOST_MDNS="$TARGET_IP"
+fi
+
 # Map host.containers.internal to the rootless-podman host gateway.
 # Podman 4.4+ supports the magic string "host-gateway" which resolves to
 # the correct in-container-network gateway IP at container start. We used
@@ -916,7 +923,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q fedimint; then
     -e FM_DATA_DIR=/data -e "FM_BITCOIND_USERNAME=$BTC_RPC_USER" -e "FM_BITCOIND_PASSWORD=$BTC_RPC_PASS" \
     -e FM_BITCOIN_NETWORK=bitcoin -e FM_BIND_P2P=0.0.0.0:8173 \
     -e FM_BIND_API=0.0.0.0:8174 -e FM_BIND_UI=0.0.0.0:8175 \
-    -e FM_P2P_URL=fedimint://"$TARGET_IP":8173 -e FM_API_URL=ws://"$TARGET_IP":8174 \
+    -e FM_P2P_URL=fedimint://"$HOST_MDNS":8173 -e FM_API_URL=ws://"$HOST_MDNS":8174 \
     -e "FM_BITCOIND_URL=http://$BTC_HOST:$BTC_PORT" \
     "$FEDIMINT_IMAGE" 2>>"$LOG" || true
 fi
@@ -945,7 +952,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q fedimint-gateway; th
       --bcrypt-password-hash "$FEDI_HASH" \
       --network bitcoin --bitcoind-url "http://$BTC_HOST:$BTC_PORT" \
       --bitcoind-username "$BTC_RPC_USER" --bitcoind-password "$BTC_RPC_PASS" \
-      lnd --lnd-rpc-host "$TARGET_IP":10009 --lnd-tls-cert /lnd/tls.cert --lnd-macaroon /lnd/admin.macaroon 2>>"$LOG" || true
+      lnd --lnd-rpc-host lnd:10009 --lnd-tls-cert /lnd/tls.cert --lnd-macaroon /lnd/admin.macaroon 2>>"$LOG" || true
   else
     log "  No LND found — using ldk (built-in Lightning)"
     $DOCKER run -d --name fedimint-gateway --restart unless-stopped \