feat: NostrVPN as native system service, remove FIPS

- Convert NostrVPN from container app to native systemd service
- Auto-configure VPN with node's Nostr identity after onboarding
- Add nostr-vpn.service with proper capabilities (NET_ADMIN, NET_RAW)
- Remove FIPS from marketplace, container config, nginx, image-versions
  (consolidated into NostrVPN — same mesh VPN concept)
- Add AIUI inclusion step to dev CI workflow
- AIUI installed on VPS build server for ISO inclusion

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/configs/nostr-vpn.service

@@ -1,17 +1,36 @@
 [Unit]
-Description=Nostr VPN - Mesh VPN with Nostr signaling
-After=network-online.target tor.service
+Description=Nostr VPN - Mesh VPN with Nostr identity
+After=network-online.target tor.service archipelago.service
 Wants=network-online.target
 
 [Service]
 Type=simple
 User=root
 EnvironmentFile=-/var/lib/archipelago/nostr-vpn/env
+ExecStartPre=/bin/bash -c 'test -f /var/lib/archipelago/nostr-vpn/env || { echo "NostrVPN not configured — waiting for onboarding"; exit 1; }'
 ExecStart=/usr/local/bin/nvpn daemon
 Restart=on-failure
 RestartSec=10
+TimeoutStartSec=30
 TimeoutStopSec=10
 
+# Networking capabilities (required for TUN/WireGuard)
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE
+
+# Security hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/var/lib/archipelago/nostr-vpn /run/nostr-vpn /dev/net/tun
+ProtectHome=yes
+PrivateTmp=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictRealtime=yes
+
+# Resource limits
+MemoryMax=256M
+TasksMax=64
+
 # Logging
 StandardOutput=journal
 StandardError=journal