Tighten OSS detection, refresh TLS badge, plumb custom mempool URL

isOpenSource was matching things like Braiins OS, cgminer, bfgminer,
and a generic "esp32" — software that's open but runs on closed
hardware (Antminer, unknown rigs). public-pool's UI reserves the
star for open-source HARDWARE, with open firmware on top, and that's
the convention to match. New regex covers the family verbatim from
public-pool-ui's user-agent-link switch table:

  bitaxe, bitaxeHex, NerdMiner, NerdNOS, NerdAxe, NerdAxeGamma,
  NerdOCTAXE, NerdEKO, NerdQAxe+, NerdQAxe++, PiAxe, QAxe, QAxe+,
  0xAxe, LeafMiner

Also extend detectHardware so all those user-agents get a recognised
label instead of "esp32" / raw token.

Replace the squished "TLS" pill with an inline-flex badge: 0.78em
text, 5px corners, padlock SVG, generous left/right padding so it
reads at a glance instead of looking like a typo.

Custom block explorer: new optional union under StartOS Advanced
config ("Block Explorer" — defaults to "mempool.space"). Picking
"Custom URL" surfaces the value as MEMPOOL_BASE_URL on the
container env. config.Config picks it up, the aggregator copies
it into every Snapshot (mempool_base_url field), and the UI's
shared explorerBaseFor() helper trusts the custom URL verbatim
when present (no /testnet4 / /signet path appended — a self-hosted
instance is presumably single-network already). Falls back to the
public mempool.space mirrors per chain when unset, which is the
default behaviour.

ui/src/lib/BlocksTable.svelte

@@ -1,20 +1,15 @@
 <script lang="ts">
   import { snap } from "../stores/snapshot.svelte";
-  import { formatAgo, formatDifficulty } from "../format";
+  import { formatAgo, formatDifficulty, explorerBaseFor } from "../format";
 
   const blocks = $derived.by(() => {
     const b = snap.data?.recent_blocks ?? [];
     return [...b].reverse();
   });
 
-  // mempool.space mirror picked per network. If chain isn't known, the
-  // mainnet link still works as a best effort.
-  const explorerBase = $derived.by(() => {
-    const chain = snap.data?.chain?.chain ?? "main";
-    if (chain === "test" || chain === "testnet4") return "https://mempool.space/testnet4";
-    if (chain === "signet") return "https://mempool.space/signet";
-    return "https://mempool.space";
-  });
+  const explorerBase = $derived(
+    explorerBaseFor(snap.data?.chain?.chain, snap.data?.mempool_base_url),
+  );
 </script>
 
 <section class="card">