feat(cuprate-ui): companion dashboard for the Cuprate Monero node

Same companion shape as bitcoin-ui/electrs-ui: host-networked nginx
bound to 127.0.0.1:18091 (auth: gated + session_passthrough), serving
a dark glass status page that polls the node's restricted RPC via a
session-gated /cuprate-rpc/ proxy — sync height/target with progress
bar, peers, mempool, chain size and free disk (from get_info), plus a
wallet 'remote node' endpoint. The offline state explains the disk gate
so a refused node says why.

No secret rendering: the restricted RPC is Monero's safe-for-public
subset, so nginx.conf is baked into the image (no pre_start hook, no
bind mount). companion.rs auto-provisions archy-cuprate-ui alongside
cuprate and reaps it when cuprate goes.

Catalog regenerated (cuprate-ui entry + manifest embed, 18091 into the
mesh launch-port list). NOTE: releases/app-catalog.json is UNSIGNED as
committed — run scripts/sign-catalog.sh before publishing.

scripts/generate-app-catalog.sh

@@ -65,6 +65,7 @@ SINGLE = {
     "bitcoin-ui": "BITCOIN_UI_IMAGE",
     "lnd-ui": "LND_UI_IMAGE",
     "electrs-ui": "ELECTRS_UI_IMAGE",
+    "cuprate-ui": "CUPRATE_UI_IMAGE",
     "homeassistant": "HOMEASSISTANT_IMAGE",
     "grafana": "GRAFANA_IMAGE",
     "uptime-kuma": "UPTIME_KUMA_IMAGE",