Tighten OSS detection, refresh TLS badge, plumb custom mempool URL

isOpenSource was matching things like Braiins OS, cgminer, bfgminer,
and a generic "esp32" — software that's open but runs on closed
hardware (Antminer, unknown rigs). public-pool's UI reserves the
star for open-source HARDWARE, with open firmware on top, and that's
the convention to match. New regex covers the family verbatim from
public-pool-ui's user-agent-link switch table:

  bitaxe, bitaxeHex, NerdMiner, NerdNOS, NerdAxe, NerdAxeGamma,
  NerdOCTAXE, NerdEKO, NerdQAxe+, NerdQAxe++, PiAxe, QAxe, QAxe+,
  0xAxe, LeafMiner

Also extend detectHardware so all those user-agents get a recognised
label instead of "esp32" / raw token.

Replace the squished "TLS" pill with an inline-flex badge: 0.78em
text, 5px corners, padlock SVG, generous left/right padding so it
reads at a glance instead of looking like a typo.

Custom block explorer: new optional union under StartOS Advanced
config ("Block Explorer" — defaults to "mempool.space"). Picking
"Custom URL" surfaces the value as MEMPOOL_BASE_URL on the
container env. config.Config picks it up, the aggregator copies
it into every Snapshot (mempool_base_url field), and the UI's
shared explorerBaseFor() helper trusts the custom URL verbatim
when present (no /testnet4 / /signet path appended — a self-hosted
instance is presumably single-network already). Falls back to the
public mempool.space mirrors per chain when unset, which is the
default behaviour.

ui/src/lib/UserDetailPage.svelte

@@ -7,6 +7,7 @@
     formatAgo,
     detectHardware,
     isOpenSource,
+    explorerBaseFor,
   } from "../format";
   import type { Worker, StratumClient } from "../types";
 
@@ -133,12 +134,9 @@
     };
   });
 
-  const explorerBase = $derived.by(() => {
-    const chain = snap.data?.chain?.chain ?? "main";
-    if (chain === "test" || chain === "testnet4") return "https://mempool.space/testnet4";
-    if (chain === "signet") return "https://mempool.space/signet";
-    return "https://mempool.space";
-  });
+  const explorerBase = $derived(
+    explorerBaseFor(snap.data?.chain?.chain, snap.data?.mempool_base_url),
+  );
 
   function onKey(ev: KeyboardEvent): void {
     if (ev.key === "Escape") clearSelection();
@@ -227,7 +225,12 @@
                   <div class="wname mono">
                     {r.worker}
                     {#if r.tls}
-                      <span class="badge tls" title="Connected via TLS">TLS</span>
+                      <span class="badge tls" title="Connected via TLS">
+                        <svg viewBox="0 0 14 14" aria-hidden="true">
+                          <path d="M4 6V4.5a3 3 0 0 1 6 0V6h.5a1 1 0 0 1 1 1v5a1 1 0 0 1-1 1h-7a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1H4Zm1.4 0h3.2V4.5a1.6 1.6 0 0 0-3.2 0V6Z"/>
+                        </svg>
+                        <span>TLS</span>
+                      </span>
                     {/if}
                   </div>
                   {#if r.sourceIp}
@@ -353,16 +356,25 @@
     margin-top: 0.2em;
   }
   .badge.tls {
-    display: inline-block;
-    font-size: 0.65em;
+    display: inline-flex;
+    align-items: center;
+    gap: 0.32em;
+    font-size: 0.78em;
     font-weight: 600;
-    letter-spacing: 0.03em;
+    letter-spacing: 0.04em;
     color: var(--good);
-    border: 1px solid #2f5c48;
-    background: #0f2419;
-    padding: 0.05em 0.45em;
-    border-radius: 999px;
-    vertical-align: 1px;
+    border: 1px solid #3a7558;
+    background: #112e22;
+    padding: 0.18em 0.55em 0.18em 0.4em;
+    border-radius: 5px;
+    text-transform: uppercase;
+    line-height: 1;
+  }
+  .badge.tls svg {
+    width: 0.95em;
+    height: 0.95em;
+    fill: currentColor;
+    flex-shrink: 0;
   }
   .oss {
     color: var(--accent);