lscr.io is a mirror of ghcr.io — same manifests and auth service.
Using the ghcr.io token flow (with GITHUB_TOKEN) is reliable; calling
the lscr.io token endpoint with service=lscr.io silently fails.
lscr.io is backed by ghcr.io and requires a GitHub token for registry
auth — passing it fixes the silent null return from the token endpoint.
Widget now shows only confirmed outdated/current containers, with
unverified and unsupported-registry images summarised as a footer count.