Build SpacesOps StartOS package (v1.0.0:0)

Initial .s9pk for SpacesOps, targeting StartOS 0.4.0.x with SDK 1.5.1.

- Single managed daemon from spacesops/spacesops:v1.0.0 (x86_64 + aarch64),
  keeping the image entrypoint (/app/docker-entrypoint.sh node server.js).
  Forces PLATFORM_HOST=0.0.0.0 / PLATFORM_PORT=7264 so the StartOS proxy can
  reach the app. Single `ui` interface on 7264.
- Depends on the Spaces service (>=0.0.9:3) and auto-wires the spaced RPC creds:
  main.ts mounts the Spaces `main` volume read-only at /spaces-data, execs a
  read of its store.json inside the subcontainer, and injects SPACED_RPC_USER/
  PASSWORD + SPACED_RPC_URL=http://spaces.startos:7225. Throws to retry until
  Spaces is installed and seeded.
- Generates a Nostr operator keypair (nostr-tools, bundled by ncc) and a strong
  session secret in idempotent init tasks (.once() reads, allowWriteAfterConst
  merges). Actions: show-operator-credentials, import-operator-key,
  show-admin-credentials (surfaces the fixed admin/Whatever! login with a
  warning), configure-platform (optional relay/mode/CoinGecko/SUBSD).
- Install alert warns to install Spaces first and about the fixed admin
  credential. Backs up the `main` volume.
- Icon: icon.svg (source spacesops.svg). The `spaces` dependency uses
  assets/spaces-icon.png for its Marketplace metadata.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

startos/utils.ts

@@ -0,0 +1,44 @@
+import { utils } from '@start9labs/start-sdk'
+
+// The SpacesOps HTTP server. The app defaults to 127.0.0.1:3000; we override
+// PLATFORM_HOST to 0.0.0.0 and PLATFORM_PORT to this so the StartOS reverse
+// proxy can reach it.
+export const uiPort = 7264
+
+// Our own volume.
+export const dataDir = '/data'
+
+// Where the Spaces 'main' volume is mounted (read-only) so we can read the
+// spaced RPC credentials Spaces seeded into its store.json.
+export const spacesDataDir = '/spaces-data'
+
+// The Spaces package this service depends on.
+export const SPACES_PACKAGE_ID = 'spaces'
+
+// Spaces exposes its spaced JSON-RPC as the `spaces-api` interface on 7225,
+// reachable from a dependent package at this address.
+export const SPACED_RPC_URL = 'http://spaces.startos:7225'
+export const SPACED_WALLETLOAD_NAME = 'main'
+
+// Admin Basic Auth is baked into the v1.0.0 image with NO env override. It
+// cannot be changed without rebuilding the image. Surfaced (with a warning)
+// via the "Show Admin Credentials" action.
+export const ADMIN_USER = 'admin'
+export const ADMIN_PASSWORD = 'Whatever!'
+
+// Optional-config defaults (see the "Configure Platform" action).
+export const DEFAULT_OPERATOR_RELAY = 'wss://relay.primal.net'
+export const DEFAULT_PLATFORM_MODE = 'prod'
+export const DEFAULT_COINGECKO_TOKEN_COINS = 'bitcoin'
+
+// 32 random bytes as a 64-char hex string — a secp256k1/Nostr secret key. The
+// odds of an out-of-range key are ~1 in 2^128; if getPublicKey rejects it,
+// init throws and StartOS retries with fresh entropy.
+export function randomOperatorSecretHex(): string {
+  return utils.getDefaultString({ charset: '0-9,a-f', len: 64 })
+}
+
+// A strong replacement for the app's weak hardcoded PLATFORM_SESSION_SECRET.
+export function randomSessionSecret(): string {
+  return utils.getDefaultString({ charset: 'a-z,A-Z,0-9', len: 48 })
+}