Polish pass: sysops wording, QR size, NWC toolbar, logo, diagnostics placement

Eight fixes from live testing:

Systems Operational modal:
- Drop the "test from your phone on mobile data" (hairpin NAT) sentence
  from the router note — too technical for the intended audience.
- Node-only role: when BTCPay Server and Lightning Wallet Connections
  (LNURL) are both off, the router card becomes a simple "No router
  setup needed yet" note explaining that ports 80/443 only matter if
  one of those services is turned on. When one is enabled, the card
  shows the same port steps and live domain/port diagnostics as the
  Desktop + Server role (diagnostics now poll only enabled services).

Service modals:
- The Domain Diagnostic Checklist now shows only the domain-active
  step (Domain Configured). DNS and port diagnostics live in Systems
  Operational, which shows the full checklist.
- Node-only role: BTCPay Server and Lightning Wallet Connections
  modals gain a "Ports to Forward in Your Router" section with the
  standard 80/443 wording and this computer's LAN address.
- Domain setup and reconfigure dialogs no longer contain router
  port-forwarding instructions (already handled during Desktop +
  Server onboarding and shown in Systems Operational).

Lightning Wallet Connections:
- Refresh and New Wallet toolbar buttons now share one height and
  baseline (a leftover 12px top margin on Refresh was offsetting it).
- The header status chip has a proper gap between the status dot and
  its label.

Zeus Connect / QR codes:
- QR codes render at the original 240px with the white frame and
  pixelated upscaling, restoring scannability.

Brand:
- The sidebar logo loads via /static/sovran-hub-icon.svg (same as the
  login page) instead of an inline <use> symbol — the gradient-heavy
  symbol did not render reliably. The icon sprite is hidden with the
  browser-safe zero-size pattern instead of display:none.

app/sovran_systemsos_web/static/js/service-detail.js

@@ -718,7 +718,11 @@ async function openServiceDetailModal(unit, name, icon) {
 
     // Section C: Domain diagnostics (domain services)
     if (data.needs_domain) {
-      var steps = data.domain_check_steps || [];
+      // The Hub shows only the domain-active step here; the full DNS and
+      // port diagnostics live in the Systems Operational modal.
+      var steps = (data.domain_check_steps || []).filter(function (s) {
+        return Number(s.step) === 1;
+      });
       var stepsHtml = "";
       steps.forEach(function(step) {
         var iconLabel = "—";
@@ -747,6 +751,17 @@ async function openServiceDetailModal(unit, name, icon) {
         domainActionHtml +
         '</div>');
 
+      // Node-only role: BTCPay Server and Lightning Wallet Connections are
+      // the domain services — surface the router task here. (Desktop + Server
+      // set this up during onboarding; Systems Operational shows it too.)
+      if (typeof _currentRole !== "undefined" && _currentRole === "node" &&
+          (unit === "btcpayserver.service" || unit === "albyhub.service")) {
+        addSetup('<div class="svc-detail-section">' +
+          '<div class="svc-detail-section-title">Ports to Forward in Your Router</div>' +
+          '<div class="onboarding-port-warn" id="svc-node-router-box"></div>' +
+          '</div>');
+      }
+
       if (data.router_ports && data.router_ports.length > 0) {
         var trimmedInternalIp = data.internal_ip ? String(data.internal_ip).trim() : "";
         addSetup('<div class="svc-detail-section">' +
@@ -1004,6 +1019,9 @@ async function openServiceDetailModal(unit, name, icon) {
     $credsBody.innerHTML = html;
     if (isNwc) _nwcWireTabs();
     _attachCopyHandlers($credsBody);
+    if (document.getElementById("svc-node-router-box")) {
+      renderRouterPortsBox("svc-node-router-box");
+    }
     if (_isNwcServiceUnit(unit) && (effectiveEnabled || data.enabled)) {
       await _nwcInitWalletFlow(unit, name, icon);
       var nwcRtlBtn = document.getElementById("nwc-open-rtl-btn");