fix: onboarding redirect, login Enter key, uidmap, Tor perms, QEMU CI

Frontend:
- Router guard checks isOnboardingComplete before redirecting to /login.
  Fresh installs now go to /onboarding/intro instead of stuck on login.
- Login.vue: autocomplete="off" — fixes Enter key focusing button
  instead of submitting the form.

ISO build:
- Added uidmap, slirp4netns, fuse-overlayfs to rootfs (required for
  rootless Podman, lost to --no-install-recommends)
- Tor setup: mkdir + chmod 700 for hidden service dirs before starting
  (Tor refuses 750/setgid permissions)

CI:
- QEMU headless boot test step after smoke test

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/router/index.ts

@@ -287,6 +287,19 @@ router.beforeEach(async (to, _from, next) => {
       next()
       return
     }
+    // Check if this is a fresh install that needs onboarding
+    try {
+      const { isOnboardingComplete } = await import('@/composables/useOnboarding')
+      const setupDone = await isOnboardingComplete()
+      if (!setupDone) {
+        next('/onboarding/intro')
+        return
+      }
+    } catch {
+      // If we can't check, assume fresh install and show onboarding
+      next('/onboarding/intro')
+      return
+    }
     next({ path: '/login', query: { redirect: to.fullPath } })
     return
   }

neode-ui/src/views/Login.vue

@@ -53,7 +53,7 @@
               id="setup-password"
               v-model="password"
               type="password"
-              autocomplete="new-password"
+              autocomplete="off"
               class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white placeholder-white/40 focus:outline-none focus:border-white/40 focus:ring-1 focus:ring-white/20 transition-colors"
               :placeholder="t('login.enterPasswordSetup')"
               @keyup.enter="handleSetupWithSound"
@@ -69,7 +69,7 @@
               id="setup-confirm-password"
               v-model="confirmPassword"
               type="password"
-              autocomplete="new-password"
+              autocomplete="off"
               class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white placeholder-white/40 focus:outline-none focus:border-white/40 focus:ring-1 focus:ring-white/20 transition-colors"
               :placeholder="t('login.confirmPasswordPlaceholder')"
               @keyup.enter="handleSetupWithSound"
@@ -153,7 +153,7 @@
               id="login-password"
               v-model="password"
               type="password"
-              autocomplete="current-password"
+              autocomplete="off"
               class="w-full px-4 py-3 bg-transparent border border-white/20 rounded-lg text-white placeholder-white/40 focus:outline-none focus:border-white/40 focus:ring-1 focus:ring-white/20 transition-colors"
               :placeholder="t('login.enterPasswordPlaceholder')"
               @keyup.enter="handleLoginWithSound"