Add Block Explorer config, log TLS handshakes at notice level

Two related polish items:

1. Optional custom block explorer. New union under Advanced config
   ("Block Explorer") defaulting to "mempool.space". Picking
   "Custom URL" reveals a single text field where the user can
   point Kamado at their own mempool instance — useful for users
   running mempool as a sibling StartOS service or on the same LAN.
   The entrypoint reads .advanced.mempool-explorer.{type,url} and
   exports MEMPOOL_BASE_URL when type=custom; otherwise leaves it
   empty and the UI keeps its mempool.space defaults.

2. stunnel debug level 4 (warning) was hiding successful TLS
   handshakes — only failures showed up in the service logs, which
   made it hard to confirm "yes, my miner did connect over TLS"
   without going looking at netstat. Bump to level 5 (notice) so
   each successful handshake produces an "accepted connection from
   <ip>" / "connected from <ip>" line. Errors stay visible at level
   3, so the only thing this changes is making the happy path
   observable.

docker_entrypoint.sh

@@ -51,6 +51,18 @@ ZMQ_ENABLED=$(q '.advanced.zmq-enabled // true')
 TLS_ENABLED=$(q '.tls.enabled // "disabled"')
 TLS_PORT=$(q '.tls.port // 3334')
 
+# Empty MEMPOOL_BASE_URL means "use mempool.space defaults". When the
+# user picks "Custom URL" in advanced config, we surface the value so
+# kamado-api can include it in the snapshot and the UI can rewrite
+# explorer links to point at the user's own mempool instance.
+MEMPOOL_TYPE=$(q '.advanced.mempool-explorer.type // "default"')
+if [[ "${MEMPOOL_TYPE}" == "custom" ]]; then
+    MEMPOOL_BASE_URL=$(q '.advanced.mempool-explorer.url // ""')
+else
+    MEMPOOL_BASE_URL=""
+fi
+export MEMPOOL_BASE_URL
+
 # CKPool-solo uses the worker's stratum username as the payout
 # address and refuses to authenticate workers whose username is not
 # a valid address on the active network. The conf `btcaddress` is
@@ -256,7 +268,12 @@ OPENSSL_CONF
 foreground = yes
 pid =
 output = /dev/stdout
-debug = 4
+# debug = 5 (notice) so each successful TLS handshake produces a
+# "Service [stratum] accepted connection" / "connected from" pair
+# in the service logs. Failures (bad cert, alert messages, cipher
+# rejection) still surface at level 3, so both happy- and sad-path
+# events are visible without flipping levels per incident.
+debug = 5
 # Pin a modern TLS floor. Any miner firmware younger than ~2018
 # speaks TLS 1.2, and TLS 1.0/1.1 are deprecated anyway.
 sslVersion = all