Upgrade to SpacesOps v1.0.1 and fix v1.0.1:1 startup on StartOS.

Bump the image to spacesops/spacesops:v1.0.1, always inject NODE_EXTRA_CA_CERTS from sdk.getSslCertificate so the upstream entrypoint no longer crashes on unset _SCRIPT_DIR, and document the same-host HTTPS behavior in the README.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -39,7 +39,7 @@ auto-connects to it — see [Installation and First-Run Flow](#installation-and-
 
 | Field | Value |
 | --- | --- |
-| Image | `docker.io/spacesops/spacesops:v1.0.0` |
+| Image | `docker.io/spacesops/spacesops:v1.0.1` |
 | Base | `node:20-alpine` |
 | Architectures | `x86_64` (linux/amd64), `aarch64` (linux/arm64) |
 | Entrypoint | The image's `/app/docker-entrypoint.sh` is **kept**. StartOS runs `/app/docker-entrypoint.sh node server.js` as the daemon. |
@@ -139,7 +139,7 @@ volume is **not** part of this package's backup.
    and sync Spaces before (or alongside) SpacesOps; the service restarts until
    those credentials are available.
 2. **The admin password is fixed and well-known.** Admin Basic Auth is hardcoded
-   in the v1.0.0 image as `admin` / `Whatever!` with **no environment override**.
+   in the v1.0.1 image as `admin` / `Whatever!` with **no environment override**.
    It cannot be changed without rebuilding the image. **Keep this service private
    (Tor-only) and never expose its admin routes to the public internet** — the
    admin area can run SQL and manage tenants. See **Show Admin Credentials**.
@@ -151,7 +151,11 @@ volume is **not** part of this package's backup.
 5. **The SUBS backend is not auto-wired to the Spaces subs daemon in v1.** The
    Spaces service's subs daemon listens on 7777 with a different API/auth than
    the SUBS endpoint (port 7244) SpacesOps expects, so SUBS must be configured
-   manually if used.
+   manually if used. StartOS always sets `NODE_EXTRA_CA_CERTS` to the StartOS
+   root CA (fetched via `sdk.getSslCertificate` for the SUBS `*.startos`
+   hostname when configured, otherwise `spaces.startos`) so outbound HTTPS to
+   same-host StartOS services succeeds and the v1.0.1 image entrypoint does not
+   crash on its broken `_SCRIPT_DIR` default.
 
 ## What Is Unchanged from Upstream
 
@@ -166,8 +170,8 @@ volume is **not** part of this package's backup.
 
 ```yaml
 package_id: spacesops
-upstream_version: 1.0.0
-image: docker.io/spacesops/spacesops:v1.0.0
+upstream_version: 1.0.1
+image: docker.io/spacesops/spacesops:v1.0.1
 architectures: [x86_64, aarch64]
 volumes:
   main: /data
@@ -196,6 +200,7 @@ optional_env_vars:          # only set when configured via configure-platform
   - SUBS_URI_VALUE
   - SUBS_RPC_USER
   - SUBS_RPC_PASSWORD
+  - NODE_EXTRA_CA_CERTS      # /data/.startos/startos-root-ca.crt (always set)
 admin_credentials:
   username: admin
   password: Whatever!       # FIXED, baked into image, cannot be changed