Add Block Explorer config, log TLS handshakes at notice level

Two related polish items:

1. Optional custom block explorer. New union under Advanced config
   ("Block Explorer") defaulting to "mempool.space". Picking
   "Custom URL" reveals a single text field where the user can
   point Kamado at their own mempool instance — useful for users
   running mempool as a sibling StartOS service or on the same LAN.
   The entrypoint reads .advanced.mempool-explorer.{type,url} and
   exports MEMPOOL_BASE_URL when type=custom; otherwise leaves it
   empty and the UI keeps its mempool.space defaults.

2. stunnel debug level 4 (warning) was hiding successful TLS
   handshakes — only failures showed up in the service logs, which
   made it hard to confirm "yes, my miner did connect over TLS"
   without going looking at netstat. Bump to level 5 (notice) so
   each successful handshake produces an "accepted connection from
   <ip>" / "connected from <ip>" line. Errors stay visible at level
   3, so the only thing this changes is making the happy path
   observable.

docker_entrypoint.sh

@@ -51,6 +51,18 @@ ZMQ_ENABLED=$(q '.advanced.zmq-enabled // true')
 TLS_ENABLED=$(q '.tls.enabled // "disabled"')
 TLS_PORT=$(q '.tls.port // 3334')
 
+# Empty MEMPOOL_BASE_URL means "use mempool.space defaults". When the
+# user picks "Custom URL" in advanced config, we surface the value so
+# kamado-api can include it in the snapshot and the UI can rewrite
+# explorer links to point at the user's own mempool instance.
+MEMPOOL_TYPE=$(q '.advanced.mempool-explorer.type // "default"')
+if [[ "${MEMPOOL_TYPE}" == "custom" ]]; then
+    MEMPOOL_BASE_URL=$(q '.advanced.mempool-explorer.url // ""')
+else
+    MEMPOOL_BASE_URL=""
+fi
+export MEMPOOL_BASE_URL
+
 # CKPool-solo uses the worker's stratum username as the payout
 # address and refuses to authenticate workers whose username is not
 # a valid address on the active network. The conf `btcaddress` is
@@ -256,7 +268,12 @@ OPENSSL_CONF
 foreground = yes
 pid =
 output = /dev/stdout
-debug = 4
+# debug = 5 (notice) so each successful TLS handshake produces a
+# "Service [stratum] accepted connection" / "connected from" pair
+# in the service logs. Failures (bad cert, alert messages, cipher
+# rejection) still surface at level 3, so both happy- and sad-path
+# events are visible without flipping levels per incident.
+debug = 5
 # Pin a modern TLS floor. Any miner firmware younger than ~2018
 # speaks TLS 1.2, and TLS 1.0/1.1 are deprecated anyway.
 sslVersion = all

scripts/procedures/getConfig.ts

@@ -179,6 +179,40 @@ export const getConfig: T.ExpectedExports.getConfig = compat.getConfig({
         },
         "default": "info",
       },
+      "mempool-explorer": {
+        "type": "union",
+        "name": "Block Explorer",
+        "description":
+          "Where Kamado's UI links should send you when you click a block hash or a user's BTC address. Defaults to mempool.space (the public instance). Switch to 'Custom' to point Kamado at a self-hosted mempool.space mirror — useful if you run mempool as another StartOS service or on the same network.",
+        "tag": {
+          "id": "type",
+          "name": "Source",
+          "description": "Public mempool.space, or your own instance.",
+          "variant-names": {
+            "default": "mempool.space (default)",
+            "custom": "Custom URL",
+          },
+        },
+        "default": "default",
+        "variants": {
+          "default": {},
+          "custom": {
+            "url": {
+              "type": "string",
+              "name": "Mempool URL",
+              "description":
+                "Base URL of your mempool instance, e.g. https://mempool.example.com. Kamado will append /address/<addr> and /block/<hash> to it, so the instance must follow the standard mempool.space URL layout.",
+              "nullable": false,
+              "default": "",
+              "pattern": "^https?://[^\\s]+$",
+              "pattern-description":
+                "Must be an http:// or https:// URL with no whitespace.",
+              "masked": false,
+              "copyable": false,
+            },
+          },
+        },
+      },
     },
   },
 });