Tighten OSS detection, refresh TLS badge, plumb custom mempool URL

isOpenSource was matching things like Braiins OS, cgminer, bfgminer,
and a generic "esp32" — software that's open but runs on closed
hardware (Antminer, unknown rigs). public-pool's UI reserves the
star for open-source HARDWARE, with open firmware on top, and that's
the convention to match. New regex covers the family verbatim from
public-pool-ui's user-agent-link switch table:

  bitaxe, bitaxeHex, NerdMiner, NerdNOS, NerdAxe, NerdAxeGamma,
  NerdOCTAXE, NerdEKO, NerdQAxe+, NerdQAxe++, PiAxe, QAxe, QAxe+,
  0xAxe, LeafMiner

Also extend detectHardware so all those user-agents get a recognised
label instead of "esp32" / raw token.

Replace the squished "TLS" pill with an inline-flex badge: 0.78em
text, 5px corners, padlock SVG, generous left/right padding so it
reads at a glance instead of looking like a typo.

Custom block explorer: new optional union under StartOS Advanced
config ("Block Explorer" — defaults to "mempool.space"). Picking
"Custom URL" surfaces the value as MEMPOOL_BASE_URL on the
container env. config.Config picks it up, the aggregator copies
it into every Snapshot (mempool_base_url field), and the UI's
shared explorerBaseFor() helper trusts the custom URL verbatim
when present (no /testnet4 / /signet path appended — a self-hosted
instance is presumably single-network already). Falls back to the
public mempool.space mirrors per chain when unset, which is the
default behaviour.

api/internal/config/config.go

@@ -34,6 +34,11 @@ type Config struct {
 
 	// Poll interval for refreshing ckpool stats
 	PollInterval time.Duration
+
+	// Optional mempool.space-compatible explorer base URL. Empty means
+	// the UI uses the public mempool.space; non-empty means the user
+	// has pointed Kamado at their own instance via the StartOS config.
+	MempoolBaseURL string
 }
 
 func FromEnv() (*Config, error) {
@@ -48,6 +53,7 @@ func FromEnv() (*Config, error) {
 		CKPoolLogFile:     getenv("CKPOOL_LOGFILE", "/var/log/ckpool/ckpool.log"),
 		DBPath:            getenv("DB_PATH", "/var/lib/kamado/kamado.db"),
 		PollInterval:      getenvDuration("POLL_INTERVAL", 5*time.Second),
+		MempoolBaseURL:    os.Getenv("MEMPOOL_BASE_URL"),
 	}
 
 	if cfg.BitcoinRPCURL == "" {