fix(mesh): Reticulum garbage-text + reconnect churn + signal bars + node naming/HTTPS

- reticulum.rs: send_text_msg was lossy-UTF8-mangling binary CBOR control
  envelopes (ReadReceipt etc.) before sending as LXMF text; base64-encode
  with a marker instead, decoded losslessly on receive.
- typed_messages.rs: mesh.send-read-receipt fired automatically on every
  chat view with no is_archy_peer gate, so viewing a message from a stock
  (non-archy) LXMF peer auto-sent it an undecodable control envelope,
  surfacing as garbage text right after whatever it just sent. Now a no-op
  for non-archy peers.
- mesh/listener/mod.rs: RX_STALL_TIMEOUT was 300s and forced a full
  auto-detect reconnect on any otherwise-healthy but quiet mesh link
  (visible as "Connecting..." flapping); this also wiped Reticulum's
  in-memory peer-address table every cycle, breaking messaging with peers
  who hadn't re-announced in the window. Bumped to 1800s.
- reticulum.rs: persist the peer prefix/dest-hash/display-name table to
  disk so a restart doesn't force every peer back to "Anonymous Peer"
  until they re-announce.
- decode.rs/frames.rs: Meshcore was discarding the SNR its wire format
  carries; wire it onto the peer record. Mesh.vue's signalBars() now falls
  back to SNR-based bars when RSSI is unavailable (always true for
  Meshcore); Reticulum has neither and correctly stays at 0/"no data".
- system/handlers.rs, dispatcher.rs: new system.get-hostname RPC + cert
  regeneration (with a proper SAN) whenever server.set-name changes the
  hostname, so HTTPS doesn't add a mismatch warning on top of the
  self-signed one after a rename.
- AccountInfoSection.vue: surface the mDNS hostname + http/https links in
  Settings (HTTPS needed for mic/camera secure-context features) — never
  forced, both keep working.
- build-auto-installer-iso.sh: ship avahi-daemon so .local names actually
  resolve on the LAN, and give the self-signed cert a real SAN instead of
  a bare CN, both at image-build and install-time-fallback.
- Mesh.vue/MediaLightbox.vue/mesh-styles.css: mic/attach-stack no longer
  closes on a plain hover-past; mesh images open in the shared lightbox
  and have a real download button; lightbox close button moves to
  bottom-center on mobile instead of under the status bar; mesh device
  panel gets the same height/padding as its sibling tabs.

Verified: 108/108 mesh unit tests, deployed + confirmed healthy on
.116/.198/.228 (matching binary hash across all three), live Reticulum
messaging confirmed working end-to-end post-deploy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

image-recipe/_archived/build-auto-installer-iso.sh

@@ -323,6 +323,9 @@ RUN apt-get update && apt-get -y full-upgrade && apt-get install -y --no-install
     polkitd \
     openssh-server \
     nginx \
+    avahi-daemon \
+    avahi-utils \
+    libnss-mdns \
     podman \
     catatonit \
     uidmap \
@@ -416,12 +419,16 @@ RUN ln -sf /etc/nginx/sites-available/archipelago /etc/nginx/sites-enabled/archi
 # Install nginx snippets (PWA config, HTTPS app proxies)
 COPY snippets/ /etc/nginx/snippets/
 
-# Generate self-signed SSL certificate for HTTPS (PWA install requires secure context)
+# Generate self-signed SSL certificate for HTTPS (PWA install + mic/camera
+# access both require a secure context). SAN covers the install-time default
+# hostname -- server.set-name regenerates this with the new hostname's SAN
+# if a node is renamed.
 RUN mkdir -p /etc/archipelago/ssl && \
     openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
     -keyout /etc/archipelago/ssl/archipelago.key \
     -out /etc/archipelago/ssl/archipelago.crt \
-    -subj "/C=XX/ST=Bitcoin/L=Node/O=Archipelago/CN=archipelago" && \
+    -subj "/C=XX/ST=Bitcoin/L=Node/O=Archipelago/CN=archipelago" \
+    -addext "subjectAltName=DNS:archipelago,DNS:archipelago.local,DNS:localhost,IP:127.0.0.1" && \
     chmod 600 /etc/archipelago/ssl/archipelago.key
 
 # Create archipelago systemd service
@@ -479,6 +486,7 @@ RUN systemctl enable NetworkManager || true && \
     systemctl enable polkit || systemctl enable polkit.service || true && \
     systemctl enable ssh || true && \
     systemctl enable nginx || true && \
+    systemctl enable avahi-daemon || true && \
     systemctl enable archipelago || true && \
     systemctl enable tor || true && \
     systemctl enable tailscaled || true && \
@@ -3039,7 +3047,8 @@ if [ ! -f /mnt/target/etc/archipelago/ssl/archipelago.crt ]; then
     chroot /mnt/target openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
         -keyout /etc/archipelago/ssl/archipelago.key \
         -out /etc/archipelago/ssl/archipelago.crt \
-        -subj "/C=XX/ST=Bitcoin/L=Node/O=Archipelago/CN=archipelago" 2>/dev/null
+        -subj "/C=XX/ST=Bitcoin/L=Node/O=Archipelago/CN=archipelago" \
+        -addext "subjectAltName=DNS:archipelago,DNS:archipelago.local,DNS:localhost,IP:127.0.0.1" 2>/dev/null
     chmod 600 /mnt/target/etc/archipelago/ssl/archipelago.key
     echo "   Generated self-signed SSL certificate"
 fi