feat: NostrVPN as native system service, Claude API key input, fix duplicate password

- Add NostrVPN as a native systemd service (extracted from container)
- Add VPN status detection for nostr-vpn in backend vpn.rs
- ISO build extracts nvpn binary from container image
- First-boot auto-configures NostrVPN with node's Nostr identity
- Change Claude Auth from login iframe to API key input field
- Remove duplicate ChangePasswordSection from Settings.vue
- FIPS and Routstr remain as installable container apps

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -365,6 +365,7 @@ COPY archipelago-reconcile.service /etc/systemd/system/archipelago-reconcile.ser
 COPY archipelago-reconcile.timer /etc/systemd/system/archipelago-reconcile.timer
 COPY archipelago-tor-helper.service /etc/systemd/system/archipelago-tor-helper.service
 COPY archipelago-tor-helper.path /etc/systemd/system/archipelago-tor-helper.path
+COPY nostr-vpn.service /etc/systemd/system/nostr-vpn.service
 
 # Copy container doctor + reconcile scripts (referenced by the services above)
 RUN mkdir -p /home/archipelago/archy/scripts/lib
@@ -474,6 +475,12 @@ NGINXCONF
         echo "   Using tor-helper path unit from configs/"
     fi
 
+    # Copy NostrVPN system service (native mesh VPN, not a container)
+    if [ -f "$SCRIPT_DIR/configs/nostr-vpn.service" ]; then
+        cp "$SCRIPT_DIR/configs/nostr-vpn.service" "$WORK_DIR/nostr-vpn.service"
+        echo "   Using nostr-vpn.service from configs/"
+    fi
+
     # Use archipelago.service from configs/ (User=root for Podman container access)
     if [ -f "$SCRIPT_DIR/configs/archipelago.service" ]; then
         cp "$SCRIPT_DIR/configs/archipelago.service" "$WORK_DIR/archipelago.service"
@@ -923,6 +930,29 @@ BACKENDFILE
     fi
 fi
 
+# Extract NostrVPN binary from container image (native system service, not a container app)
+echo "   Extracting NostrVPN binary..."
+NVPN_IMAGE="$($CONTAINER_CMD images -q 80.71.235.15:3000/archipelago/nostr-vpn:v0.3.4 2>/dev/null)"
+if [ -z "$NVPN_IMAGE" ]; then
+    $CONTAINER_CMD pull 80.71.235.15:3000/archipelago/nostr-vpn:v0.3.4 2>/dev/null || true
+fi
+NVPN_CONTAINER=$($CONTAINER_CMD create 80.71.235.15:3000/archipelago/nostr-vpn:v0.3.4 2>/dev/null) || true
+if [ -n "$NVPN_CONTAINER" ]; then
+    $CONTAINER_CMD cp "$NVPN_CONTAINER:/usr/local/bin/nvpn" "$ARCH_DIR/bin/nvpn" 2>/dev/null && \
+        chmod +x "$ARCH_DIR/bin/nvpn" && \
+        echo "   ✅ NostrVPN binary extracted ($(du -h "$ARCH_DIR/bin/nvpn" | cut -f1))"
+    $CONTAINER_CMD rm "$NVPN_CONTAINER" 2>/dev/null || true
+else
+    echo "   ⚠  NostrVPN image not available — nvpn binary will be missing"
+fi
+
+# Copy NostrVPN UI dashboard for nginx serving
+if [ -d "$SCRIPT_DIR/../docker/nostr-vpn-ui" ]; then
+    mkdir -p "$ARCH_DIR/web-ui/nostr-vpn"
+    cp "$SCRIPT_DIR/../docker/nostr-vpn-ui/index.html" "$ARCH_DIR/web-ui/nostr-vpn/"
+    echo "   ✅ NostrVPN UI dashboard included"
+fi
+
 # Capture web UI from live server
 if [ "$BUILD_FROM_SOURCE" = "1" ]; then
     echo "   Building web UI from source..."