refactor: create shared script library, fix ISO image pinning, document planned splits

- S21: Create scripts/lib/common.sh with shared logging, SSH, health check, mem_limit functions
- S18: Source common.sh from deploy-to-target.sh, deploy-tailscale.sh, first-boot-containers.sh
- S16: Fix 2 hardcoded images in ISO build, add missing image variables
- S19: Document planned 7-module split of build-auto-installer-iso.sh
- S20: Document planned 8-module split of first-boot-containers.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -21,6 +21,26 @@
 # - Automatic installation with progress display
 # - Boots directly to web UI after install
 #
+# Image versions: sourced from scripts/image-versions.sh (single source of truth).
+# All container image references MUST use the $*_IMAGE variables defined there.
+#
+# --- PLANNED REFACTOR (post-beta) ---
+# This script is ~1870 lines and should be split into a modular library.
+# Proposed structure:
+#   image-recipe/
+#     build-auto-installer-iso.sh   — Main orchestrator (config, CLI args, step sequencing)
+#     lib/
+#       rootfs.sh                   — Step 1: Build root filesystem via Docker (~185 lines)
+#       installer-env.sh            — Step 2: Download/extract Debian Live base ISO (~80 lines)
+#       components.sh               — Step 3: Add Archipelago components (binary, configs, web UI) (~120 lines)
+#       container-images.sh         — Step 3b: Bundle container images for offline install (~330 lines)
+#       auto-install-script.sh      — Step 4: Generate the embedded auto-install.sh (~615 lines)
+#       boot-config.sh              — Step 5: Configure live boot auto-start + overlay squashfs (~215 lines)
+#       create-iso.sh               — Step 6: Build final bootable ISO with xorriso/grub (~140 lines)
+# Each lib/ script exports functions; main script sources them and calls in sequence.
+# DO NOT split until tested on the build server — this is critical infrastructure.
+# ---
+#
 
 set -e
 
@@ -616,7 +636,7 @@ ${FEDIMINT_GATEWAY_IMAGE:-docker.io/fedimint/gatewayd:v0.5.1} fedimint-gateway.t
 ${FILEBROWSER_IMAGE:-docker.io/filebrowser/filebrowser:v2} filebrowser.tar
 ${ALPINE_TOR_IMAGE:-docker.io/andrius/alpine-tor:0.4.8.13} alpine-tor.tar
 ${NGINX_ALPINE_IMAGE:-docker.io/library/nginx:alpine} nginx-alpine.tar
-ghcr.io/tbd54566975/dwn-server:main dwn-server.tar
+${DWN_SERVER_IMAGE:-ghcr.io/tbd54566975/dwn-server:main} dwn-server.tar
 ${GRAFANA_IMAGE:-docker.io/grafana/grafana:11.4.0} grafana.tar
 ${UPTIME_KUMA_IMAGE:-docker.io/louislam/uptime-kuma:1} uptime-kuma.tar
 ${VAULTWARDEN_IMAGE:-docker.io/vaultwarden/server:1.32.5} vaultwarden.tar
@@ -628,7 +648,7 @@ ${PHOTOPRISM_IMAGE:-docker.io/photoprism/photoprism:240915} photoprism.tar
 ${NEXTCLOUD_IMAGE:-docker.io/library/nextcloud:30} nextcloud.tar
 ${NPM_IMAGE:-docker.io/jc21/nginx-proxy-manager:2} nginx-proxy-manager.tar
 ${IMMICH_IMAGE:-ghcr.io/immich-app/immich-server:v1.123.0} immich-server.tar
-docker.io/library/postgres:14-alpine postgres-immich.tar
+${IMMICH_POSTGRES_IMAGE:-ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0} postgres-immich.tar
 ${INDEEDHUB_REDIS_IMAGE:-docker.io/library/redis:7-alpine} redis-immich.tar
 ${ONLYOFFICE_IMAGE:-docker.io/onlyoffice/documentserver:8.2} onlyoffice.tar
 ${ADGUARDHOME_IMAGE:-docker.io/adguard/adguardhome:v0.107.55} adguardhome.tar
@@ -840,6 +860,11 @@ if [ "$UNBUNDLED" = "1" ]; then
     echo "   Skipping first-boot containers (UNBUNDLED: apps installed from Marketplace)"
 else
     echo "   Creating first-boot container creation service..."
+    # Copy shared script library
+    if [ -d "$SCRIPT_DIR/../scripts/lib" ]; then
+        mkdir -p "$ARCH_DIR/scripts/lib"
+        cp "$SCRIPT_DIR/../scripts/lib/"*.sh "$ARCH_DIR/scripts/lib/" 2>/dev/null || true
+    fi
     if [ -f "$SCRIPT_DIR/../scripts/first-boot-containers.sh" ]; then
         cp "$SCRIPT_DIR/../scripts/first-boot-containers.sh" "$ARCH_DIR/scripts/"
         chmod +x "$ARCH_DIR/scripts/first-boot-containers.sh"
@@ -1152,6 +1177,11 @@ if [ -d "$BOOT_MEDIA/archipelago/container-images" ]; then
     if [ -f "$BOOT_MEDIA/archipelago/scripts/archipelago-setup-tor.service" ]; then
         cp "$BOOT_MEDIA/archipelago/scripts/archipelago-setup-tor.service" /mnt/target/etc/systemd/system/
     fi
+    # Copy shared script library
+    if [ -d "$BOOT_MEDIA/archipelago/scripts/lib" ]; then
+        mkdir -p /mnt/target/opt/archipelago/scripts/lib
+        cp -r "$BOOT_MEDIA/archipelago/scripts/lib/"* /mnt/target/opt/archipelago/scripts/lib/ 2>/dev/null || true
+    fi
     if [ -f "$BOOT_MEDIA/archipelago/scripts/first-boot-containers.sh" ]; then
         cp "$BOOT_MEDIA/archipelago/scripts/first-boot-containers.sh" /mnt/target/opt/archipelago/scripts/
         chmod +x /mnt/target/opt/archipelago/scripts/first-boot-containers.sh