Allow operators to add their own entries to the install app catalog

## Problem

The install app catalog is hardcoded to the first-party apps:

https://github.com/basecamp/once/blob/main/internal/ui/install_app_list.go#L16-L20

There's no way for an operator to add their own entries, so deploying an image that isn't one of the three means typing a full image ref every time.

A concrete case this would serve: an agency standing up many client sites from its own small set of images. Each install is the same handful of images over and over, and none of them can be in the menu.

To be explicit, since it's an easy thing to assume: this is not a request to remove or hide your apps. Appending is what's wanted — the built-in three staying in the list is completely fine.

## Proposal

Let extra entries be supplied externally, e.g. a JSON file at `$XDG_CONFIG_HOME/once/apps.json` (falling back to `/etc/once/apps.json`), or a `ONCE_APP_CATALOG` env var pointing at one:

```json
[
{ "name": "Client site", "alias": "client-site", "image": "ghcr.io/acme/client-site" }
]
```

Same shape as the existing `KnownApp`, appended to the built-ins, so it feeds both the install menu and `expandAlias`.

One related note: `expandAlias` is currently only wired into the install/TUI path (`internal/ui/install.go`, `internal/ui/install_image_form.go`), so `once deploy ` doesn't expand. For scripted use a configurable catalog would be most valuable if `once deploy` honored aliases too — but that's a separate question and probably better kept apart from this one.

## Offer

Happy to implement this if you're open to it — basecamp/once#89 is open already, so I've spent some time in the codebase. Equally happy to have it closed if a fixed first-party catalog is a deliberate product decision.

Start with internal/ui/install_app_list.go to inspect KnownApp, the built-in catalog, and expandAlias; then trace how internal/ui/install.go and internal/ui/install_image_form.go consume those entries. Choose and document the external catalog source, append valid entries without removing built-ins, and verify that both the install menu and expandAlias use the resulting catalog.

Written by the indexing model from the issue text.