feat: UmbrelOS-style CE with iStore, Casdoor auth, and App Manager

- iStore service (port 3021): fetches app manifests from git.falahos.my/falahos
  org via Gitea API, 5-min cache, query/search support
- UmmahID login: replaced stub form with Casdoor OAuth2 PKCE flow (RFC 7636),
  no client secret required; /api/auth/config and /api/auth/token endpoints
  added to server.cjs
- App Manager service (port 3022): installs/uninstalls Docker apps via
  /var/run/docker.sock, pulls images, starts containers on falah-net,
  persists state to /data/installed.json
- docker-compose.yml: orchestrates falah-app + istore + app-manager with
  health checks, named volumes, and shared falah-net network
- install.sh: one-line curl installer — checks prereqs, clones repo,
  prompts for credentials, builds and starts all containers
- .env.example: all env vars documented (CASDOOR_CLIENT_ID, GITEA_TOKEN,
  APP_MANAGER_PORT, etc.)
- Frontend: IStore overlay now fetches live apps from Gitea, real
  install/uninstall via App Manager with 2s polling, indeterminate
  progress bar, Uninstall button for installed apps
- app.yml.example: developer manifest spec for publishing to iStore

services/istore/app.yml.example

@@ -0,0 +1,26 @@
+# Falah OS iStore — App Manifest
+# Place this file as `app.yml` at the root of your Gitea repo under the `falahos` org.
+# The iStore service reads this to list and describe your app.
+
+# Required fields
+id: my-app-id               # Unique slug, kebab-case, no spaces (e.g. zakat-vault)
+name: My App Name           # Display name shown in iStore
+version: 1.0.0              # Semver
+tagline: One-line description of what this app does
+category: Finance           # Finance | Charity | Worship | Identity | Community | Contracts | Compliance | Dev Tools | Legal | Insurance | Payments | DeFi | Investment
+
+# Shariah compliance
+ramz_verified: true         # true = RAMZ-screened, false = community-submitted (pending review)
+
+# Docker
+image: falahapps/my-app:1.0.0   # Docker Hub image (or registry URL)
+port: 3030                       # Container port this app listens on
+
+# Optional display
+icon: 📦                    # Emoji icon shown in iStore and desktop
+featured: false             # true = shown in Featured section on iStore homepage
+
+# Metadata
+author: Falah Consultancy Limited
+license: MIT
+min_ce_version: 1.3.0      # Minimum Falah OS CE version required