fix: onboarding redirect, login Enter key, uidmap, Tor perms, QEMU CI

Frontend:
- Router guard checks isOnboardingComplete before redirecting to /login.
  Fresh installs now go to /onboarding/intro instead of stuck on login.
- Login.vue: autocomplete="off" — fixes Enter key focusing button
  instead of submitting the form.

ISO build:
- Added uidmap, slirp4netns, fuse-overlayfs to rootfs (required for
  rootless Podman, lost to --no-install-recommends)
- Tor setup: mkdir + chmod 700 for hidden service dirs before starting
  (Tor refuses 750/setgid permissions)

CI:
- QEMU headless boot test step after smoke test

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/router/index.ts

@@ -287,6 +287,19 @@ router.beforeEach(async (to, _from, next) => {
       next()
       return
     }
+    // Check if this is a fresh install that needs onboarding
+    try {
+      const { isOnboardingComplete } = await import('@/composables/useOnboarding')
+      const setupDone = await isOnboardingComplete()
+      if (!setupDone) {
+        next('/onboarding/intro')
+        return
+      }
+    } catch {
+      // If we can't check, assume fresh install and show onboarding
+      next('/onboarding/intro')
+      return
+    }
     next({ path: '/login', query: { redirect: to.fullPath } })
     return
   }