v1.47.0

Fixes both reports from #46 and the version-display mystery from #43 (thanks @LeeNX):

• Stale versions after self-updates ("sticky label"). Pre-v1.43.0 recreates pinned org.opencontainers.image.version=<old> onto containers; the stale value looked like a user override to the inherited-filter and stuck through every future update. org.opencontainers.* labels are now never replicated (image metadata — the new image supplies its own), and /status + Web UI read the version from the running image, which heals already-affected containers immediately.
• docksentry.protect label now visible in the Web UI: stop button hidden, 🛡 badge (🏷 when label-controlled), detail checkbox disabled under label control. The stop itself was always refused — the UI just didn't show it.
• Icon legend: keys styled like the real buttons (Update coloured, Stop red), Restart key added, tooltips everywhere, 🏷 key explained.

Not a bug: missing Stop buttons on a fresh host = advanced-mode-only control (Settings → advanced UI).