feat: NostrVPN as native system service, remove FIPS

- Convert NostrVPN from container app to native systemd service
- Auto-configure VPN with node's Nostr identity after onboarding
- Add nostr-vpn.service with proper capabilities (NET_ADMIN, NET_RAW)
- Remove FIPS from marketplace, container config, nginx, image-versions
  (consolidated into NostrVPN — same mesh VPN concept)
- Add AIUI inclusion step to dev CI workflow
- AIUI installed on VPS build server for ISO inclusion

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/configs/nginx-archipelago.conf

@@ -541,18 +541,6 @@ server {
         proxy_hide_header Content-Security-Policy;
         add_header X-Content-Type-Options "nosniff" always;
     }
-    location /app/fips/ {
-        proxy_pass http://127.0.0.1:8202/;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_hide_header X-Frame-Options;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        proxy_hide_header Content-Security-Policy;
-        add_header X-Content-Type-Options "nosniff" always;
-    }
     location /app/ollama/ {
         proxy_pass http://127.0.0.1:11434/;
         proxy_http_version 1.1;