chore(container-stack): retire nested svalinn, convert to submodule (#121)

## Summary
Completes the container-stack/ cleanup started in #119. svalinn's nested
copy was written in ReScript (banned estate-wide) and had diverged from
the standalone `hyperpolymath/svalinn` repo, which has independently
progressed further on the AffineScript/TypeScript rewrite (28 `.affine`
files vs. the nested copy's 11, far fewer leftover legacy files).

## Before retiring
Ported the nested copy's unique, non-language-specific assets forward
into `hyperpolymath/svalinn`:
- A working Rokur secrets-gate integration, documented as an exact
behavioural contract (the ReScript code itself isn't portable) —
`hyperpolymath/svalinn#64`
- Deployment/security hardening docs/config (firewalld, ModSecurity,
OpenLiteSpeed) — same PR
- The gate reimplementation itself is filed as a scoped follow-up:
`hyperpolymath/svalinn#65`
- A compiler workaround patch (`affinescript-wasm-ctor-link.patch`)
preserved for reference — almost certainly already fixed upstream
(`affinescript#602`), not verified obsolete so not discarded outright

## Result
`container-stack/` now has all 5 components (cerro-torre, vordr, selur,
rokur, svalinn) as submodules — no more full copies committed in-tree.

## Test plan
- [ ] CI green on this PR

Author: hyperpolymath

.gitmodules

@@ -10,3 +10,6 @@
 [submodule "container-stack/cerro-torre"]
 	path = container-stack/cerro-torre
 	url = https://github.com/hyperpolymath/cerro-torre.git
+[submodule "container-stack/svalinn"]
+	path = container-stack/svalinn
+	url = https://github.com/hyperpolymath/svalinn.git

container-stack/README.adoc

@@ -20,7 +20,7 @@ their own standalone repos, so there is one source of truth per component.
 | Container builder — produces cryptographically signed, minimal Chainguard-based images. Upstream repo: `hyperpolymath/cerro-torre`.
 
 | `svalinn/`
-| Edge gateway — handles routing, rate-limiting, ephemeral pinholes at the network boundary. Upstream repo: `hyperpolymath/svalinn`. *Not yet converted to a submodule* — this copy and the standalone repo have diverged (different completion state, different files) and need reconciliation before the switch; tracked separately, do not delete either copy in the meantime.
+| Edge gateway — handles routing, rate-limiting, ephemeral pinholes at the network boundary. Upstream repo: `hyperpolymath/svalinn`. Was a diverged ReScript-era copy (ReScript is banned estate-wide); retired 2026-07-04 in favour of the standalone repo's further-progressed AffineScript/TypeScript line, after porting the copy's unique Rokur-gate contract and ops docs forward (hyperpolymath/svalinn#64, #65).
 
 | `rokur/`
 | Stapeln GUI runtime — the Stapeln GUI component itself (Tauri/Dioxus shell). Upstream repo: `hyperpolymath/rokur`.