Tighten OSS detection, refresh TLS badge, plumb custom mempool URL

isOpenSource was matching things like Braiins OS, cgminer, bfgminer,
and a generic "esp32" — software that's open but runs on closed
hardware (Antminer, unknown rigs). public-pool's UI reserves the
star for open-source HARDWARE, with open firmware on top, and that's
the convention to match. New regex covers the family verbatim from
public-pool-ui's user-agent-link switch table:

  bitaxe, bitaxeHex, NerdMiner, NerdNOS, NerdAxe, NerdAxeGamma,
  NerdOCTAXE, NerdEKO, NerdQAxe+, NerdQAxe++, PiAxe, QAxe, QAxe+,
  0xAxe, LeafMiner

Also extend detectHardware so all those user-agents get a recognised
label instead of "esp32" / raw token.

Replace the squished "TLS" pill with an inline-flex badge: 0.78em
text, 5px corners, padlock SVG, generous left/right padding so it
reads at a glance instead of looking like a typo.

Custom block explorer: new optional union under StartOS Advanced
config ("Block Explorer" — defaults to "mempool.space"). Picking
"Custom URL" surfaces the value as MEMPOOL_BASE_URL on the
container env. config.Config picks it up, the aggregator copies
it into every Snapshot (mempool_base_url field), and the UI's
shared explorerBaseFor() helper trusts the custom URL verbatim
when present (no /testnet4 / /signet path appended — a self-hosted
instance is presumably single-network already). Falls back to the
public mempool.space mirrors per chain when unset, which is the
default behaviour.

api/internal/state/aggregator.go

@@ -68,6 +68,11 @@ type Snapshot struct {
 	// 24-hour hashrate history, sampled once per minute (max 1440 points).
 	HashrateHistory []HashratePoint `json:"hashrate_history,omitempty"`
 
+	// Optional override for explorer links in the UI. Empty means use
+	// mempool.space defaults. Set via MEMPOOL_BASE_URL env, surfaced by
+	// the StartOS config "Block Explorer" -> "Custom URL".
+	MempoolBaseURL string `json:"mempool_base_url,omitempty"`
+
 	// Health
 	CKPoolOK  bool   `json:"ckpool_ok"`
 	BitcoinOK bool   `json:"bitcoin_ok"`
@@ -93,6 +98,10 @@ type Aggregator struct {
 	Interval time.Duration
 	Log      *slog.Logger
 
+	// Static config that the UI consumes via the snapshot. Empty
+	// MempoolBaseURL leaves the UI on its mempool.space defaults.
+	MempoolBaseURL string
+
 	// OnRefresh, if set, is called (non-blocking) after each snapshot
 	// refresh. Used by the WebSocket hub to push updates to clients.
 	OnRefresh func(Snapshot)
@@ -187,7 +196,7 @@ func (a *Aggregator) refresh(ctx context.Context) {
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 
-	next := Snapshot{GeneratedAt: time.Now()}
+	next := Snapshot{GeneratedAt: time.Now(), MempoolBaseURL: a.MempoolBaseURL}
 
 	// --- ckpool: poolstats, users, workers, clients, uptime ---
 	if ps, err := a.CK.PoolStats(ctx); err == nil {