- Change listContainers to all:false so only running containers are discovered
- Replace loose bestMatch with strictIconMatch (exact or startsWith) to avoid
false positives from short image names matching unrelated icons
- Gate discovered apps behind DB icon match; unmatched containers are hidden
- Add CDN icon URL fallback for matched integrations display