ci(checks): whitelist tape-rotation-backend/frontend for :latest

tape-rotation is an SQLite-backed tape tracking app, similar to
3x-ui in that:
  - data lives on /home/ooyude/External (storage-guarded as of T4)
  - images are small and updated manually via Nix
  - :latest is acceptable because breaking image changes would
    fail fast at container start (storage guard + systemd)

Three image :latest entries are now whitelisted (with rationale):
  - ghcr.io/mhsanaei/3x-ui:latest (R1.5 — panel frozen, Xray is panel state)
  - docker.io/elizaroveugene/taperotation-backend:latest (this commit)
  - docker.io/elizaroveugene/taperotation-frontend:latest (this commit)

Two :latest violations remain (both in modules/containers/ but NOT
imported in modules/server/default.nix — effectively dead code):
  - localhost/kokoro-tts:latest
  - ghcr.io/openhands/openhands:latest

Decision pending: archive like T16, whitelist, or remove. They are
not running on sapphira, so the check failure is informational only.

.ci/checks.sh

@@ -27,7 +27,11 @@ REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$REPO_ROOT"
 
 LATEST_ALLOWLIST=(
+  # R1.5: 3x-ui panel frozen on :latest; Xray version is panel state (R1.8)
   "ghcr.io/mhsanaei/3x-ui:latest"
+  # tape-rotation: data on External (storage-guarded); manual updates
+  "docker.io/elizaroveugene/taperotation-backend:latest"
+  "docker.io/elizaroveugene/taperotation-frontend:latest"
 )
 
 SKIP_BUILD=false