refactor(traefik): per-app middleware hooks + moneyapp placeholder icon

Last app-specific bits out of central infra (from the per-app audit):

- traefik middleware: replace the hardcoded onlyoffice/owncloud exclude-list +
  onlyoffice-headers special-case (in traefik_middlewares.sh AND
  traefik_port_middlewares.sh) with two per-app hooks an app ships in
  containers/<app>/scripts/<app>_traefik.sh:
    appTraefikSkipsDefaultMiddleware_<app>  (marker: opt out of default@file)
    appTraefikExtraMiddlewares_<app>        (echo extra middleware entries)
  onlyoffice defines both; owncloud defines the skip marker. Two narrow hooks
  (not one clever one) so behavior — incl. the different onlyoffice-headers
  ordering between the two files — is preserved exactly. Verified with stubs:
  identical middleware strings across normal/onlyoffice/owncloud × authelia/wl.

- moneyapp: add a placeholder icon (geometric banknote SVG, 512x512) so it no
  longer falls back to default.svg in the WebUI.

Central traefik/compose code is now app-agnostic.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>

containers/moneyapp/moneyapp.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
+  <circle cx="256" cy="256" r="256" fill="#2e9e6b"/>
+  <rect x="116" y="176" width="280" height="160" rx="20" fill="#ffffff"/>
+  <circle cx="256" cy="256" r="42" fill="none" stroke="#2e9e6b" stroke-width="16"/>
+  <circle cx="168" cy="256" r="11" fill="#2e9e6b"/>
+  <circle cx="344" cy="256" r="11" fill="#2e9e6b"/>
+</svg>

containers/onlyoffice/scripts/onlyoffice_traefik.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# OnlyOffice traefik middleware hooks (consumed by traefikSetupLabelsMiddlewares
+# and tagsProcessorPortMiddlewares). It serves the document editor with its own
+# header requirements, so it opts out of the default chain and adds its own
+# headers middleware.
+
+# Marker — presence means: don't attach default@file to this app's routers.
+appTraefikSkipsDefaultMiddleware_onlyoffice() { :; }
+
+# Extra middleware entries appended for this app.
+appTraefikExtraMiddlewares_onlyoffice() { echo "onlyoffice-headers"; }

containers/owncloud/scripts/owncloud_traefik.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# ownCloud traefik middleware hook. It does its own routing, so it opts out of
+# the default middleware chain (no app-specific extras).
+
+# Marker — presence means: don't attach default@file to this app's routers.
+appTraefikSkipsDefaultMiddleware_owncloud() { :; }

scripts/network/traefik/traefik_middlewares.sh

@@ -5,16 +5,19 @@ traefikSetupLabelsMiddlewares()
     local app_name="$1"
     local middleware_entries=()
 
-    # List of app names to exclude from default middleware
+    # Default chain unless the app opts out via its per-app hook
-    local exclude_apps=("onlyoffice" "owncloud")
+    # (containers/<app>/scripts/<app>_traefik.sh defines
-    # Check if app_name is not in the list of excluded apps
+    # appTraefikSkipsDefaultMiddleware_<app>).
-    if [[ ! " ${exclude_apps[@]} " =~ " $app_name " ]]; then
+    if ! declare -F "appTraefikSkipsDefaultMiddleware_${app_name}" >/dev/null 2>&1; then
         middleware_entries+=("default@file")
     fi
 
-    # App Specific middlewears
+    # App-specific extras (e.g. onlyoffice-headers) via the per-app hook.
-    if [[ "$app_name" == "onlyoffice" ]]; then
+    if declare -F "appTraefikExtraMiddlewares_${app_name}" >/dev/null 2>&1; then
-        middleware_entries+=("onlyoffice-headers")
+        local _mw
+        while IFS= read -r _mw; do
+            [[ -n "$_mw" ]] && middleware_entries+=("$_mw")
+        done < <("appTraefikExtraMiddlewares_${app_name}")
     fi
 
     if [[ "$authelia_setup" == "true" && "$whitelist" == "true" ]]; then

scripts/network/traefik/traefik_port_middlewares.sh

@@ -26,14 +26,12 @@ tagsProcessorPortMiddlewares()
         return 0
     fi
 
-    # Excluded apps that historically opted out of the default middleware
+    # Apps opt out of the default middleware chain via a per-app hook
-    # chain — keeps existing behavior for onlyoffice / owncloud which do
+    # (containers/<app>/scripts/<app>_traefik.sh defines
-    # their own routing.
+    # appTraefikSkipsDefaultMiddleware_<app>) — e.g. onlyoffice / owncloud, which
-    local exclude_apps=("onlyoffice" "owncloud")
+    # do their own routing.
     local include_default="true"
-    if [[ " ${exclude_apps[@]} " =~ " $app_name " ]]; then
+    declare -F "appTraefikSkipsDefaultMiddleware_${app_name}" >/dev/null 2>&1 && include_default="false"
-        include_default="false"
-    fi
 
     local count=${#port_service_names[@]}
     local i=0
@@ -67,9 +65,12 @@ tagsProcessorPortMiddlewares()
                 mw+=("crowdsec-bouncer@file")
             fi
 
-            # onlyoffice / mastodon / similar app-specific middlewares
+            # App-specific extras (e.g. onlyoffice-headers) via the per-app hook.
-            if [[ "$app_name" == "onlyoffice" ]]; then
+            if declare -F "appTraefikExtraMiddlewares_${app_name}" >/dev/null 2>&1; then
-                mw+=("onlyoffice-headers")
+                local _mw
+                while IFS= read -r _mw; do
+                    [[ -n "$_mw" ]] && mw+=("$_mw")
+                done < <("appTraefikExtraMiddlewares_${app_name}")
             fi
 
             local joined; joined=$(IFS=,; echo "${mw[*]}")