fix: alpha release hardening — onboarding, security, and ISO build

- Convert "Choose Your Path" screen to informative (read-only cards)
- Harden "Choose Your Setup" (gray out Coming Soon options, auto-select Fresh Start)
- Auto-fetch DID on mount with retry and auto-advance after success
- Improve backup download for mobile compatibility
- Add retry logic to verify step with graceful skip option
- Route verify → done → login for complete onboarding flow
- Add AIUI install confirmation via custom event (SEC-001)
- Add file path whitelist for AIUI file access (SEC-002)
- Add log redaction for container logs sent to AIUI (SEC-003)
- Add Secure flag to session cookie in production (SEC-004)
- Fix ISO build script to handle zstd compression errors gracefully
- Sync archipelago.service from live server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -548,8 +548,12 @@ echo "$CONTAINER_IMAGES" | while read -r image filename; do
         echo "   Pulling $image (linux/amd64)..."
         if $CONTAINER_CMD pull --platform linux/amd64 "$image"; then
             echo "   Saving $filename..."
-            $CONTAINER_CMD save "$image" -o "$tarpath"
-            echo "   ✅ Saved: $(du -h "$tarpath" | cut -f1)"
+            if $CONTAINER_CMD save "$image" -o "$tarpath" 2>/dev/null; then
+                echo "   ✅ Saved: $(du -h "$tarpath" | cut -f1)"
+            else
+                echo "   ⚠️  Failed to save $image (zstd/format issue) - skipping"
+                rm -f "$tarpath"
+            fi
         else
             echo "   ⚠️  Failed to pull $image - skipping"
         fi

image-recipe/configs/archipelago.service

@@ -7,20 +7,10 @@ Wants=network-online.target
 Type=simple
 User=archipelago
 Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"
-Environment="ARCHIPELAGO_DEV_MODE=false"
-# Host IP for container env vars (FM_P2P_URL, etc.) - detected at startup if unset
-EnvironmentFile=-/etc/archipelago/host-ip.env
-ExecStartPre=/bin/bash -c 'mkdir -p /etc/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk \"{print \\$1}\")" > /etc/archipelago/host-ip.env'
+Environment="ARCHIPELAGO_DEV_MODE=true"
 ExecStart=/usr/local/bin/archipelago
 Restart=on-failure
 RestartSec=5
 
-# Security hardening
-NoNewPrivileges=true
-ProtectSystem=strict
-ReadWritePaths=/var/lib/archipelago
-ProtectHome=true
-PrivateTmp=true
-
 [Install]
 WantedBy=multi-user.target