Add the podsteadr-player manifest (static PWA + read-only /fips/ gateway,
pasta for IPv6 mesh egress, port 8097 auth: none) and make podsteadr depend
on it. Give podsteadr-blossom an api interface on 8098 so blob URLs in
feeds are reachable over FIPS. The catalog generator now counts auth: none
ports as service ports, so app_ports.rs gains 8097 and 8098.
Images move to the project registry and repo links to the source domain,
dropping the raw IP and production hostname from the manifests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>