fix: filebrowser registry, CI cleanup, autologin, auth debug logging

- CI: configure root podman with insecure registry so FileBrowser
  image can be pulled during ISO build
- CI: chmod u+rwX on workspace and act cache to fix cleanup failure
- ISO: auto-login on tty1 (no password prompt on console)
- Frontend: add console.log debug output for onboarding routing,
  health checks, and 401 redirects to diagnose session issues

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso.yml

@@ -14,6 +14,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          clean: false
 
       - name: Build backend
         run: |
@@ -33,6 +34,13 @@ jobs:
             echo "Cached Debian Live ISO copied ($(du -h "$WORK_DIR/debian-live-installer.iso" | cut -f1))"
           fi
 
+      - name: Configure root podman for insecure registry
+        run: |
+          sudo mkdir -p /etc/containers/registries.conf.d
+          echo '[[registry]]
+          location = "80.71.235.15:3000"
+          insecure = true' | sudo tee /etc/containers/registries.conf.d/archipelago.conf
+
       - name: Build unbundled ISO
         run: |
           cd image-recipe
@@ -110,4 +118,6 @@ jobs:
         if: always()
         run: |
           sudo chown -R $(id -u):$(id -g) . 2>/dev/null || true
+          sudo chmod -R u+rwX . 2>/dev/null || true
           sudo chown -R $(id -u):$(id -g) "$HOME/.cache/act" 2>/dev/null || true
+          sudo chmod -R u+rwX "$HOME/.cache/act" 2>/dev/null || true

neode-ui/src/api/rpc-client.ts

@@ -62,10 +62,11 @@ class RPCClient {
           // Use a single shared timeout to prevent redirect storms when
           // multiple parallel requests all get 401 at once
           if (response.status === 401 && method !== 'auth.login') {
-            // Don't redirect during onboarding — those endpoints are unauthenticated
             const isOnboarding = window.location.pathname.startsWith('/onboarding')
+            console.warn(`[RPC] 401 on ${method} | path=${window.location.pathname} | onboarding=${isOnboarding} | redirecting=${RPCClient._sessionExpiredRedirecting}`)
             if (!isOnboarding && !RPCClient._sessionExpiredRedirecting) {
               RPCClient._sessionExpiredRedirecting = true
+              console.warn(`[RPC] Session expired — redirecting to /login in 300ms`)
               setTimeout(() => {
                 window.location.href = '/login'
               }, 300)