fix: alpha release hardening — onboarding, security, and ISO build

- Convert "Choose Your Path" screen to informative (read-only cards)
- Harden "Choose Your Setup" (gray out Coming Soon options, auto-select Fresh Start)
- Auto-fetch DID on mount with retry and auto-advance after success
- Improve backup download for mobile compatibility
- Add retry logic to verify step with graceful skip option
- Route verify → done → login for complete onboarding flow
- Add AIUI install confirmation via custom event (SEC-001)
- Add file path whitelist for AIUI file access (SEC-002)
- Add log redaction for container logs sent to AIUI (SEC-003)
- Add Secure flag to session cookie in production (SEC-004)
- Fix ISO build script to handle zstd compression errors gracefully
- Sync archipelago.service from live server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/archipelago.service

@@ -7,20 +7,10 @@ Wants=network-online.target
 Type=simple
 User=archipelago
 Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"
-Environment="ARCHIPELAGO_DEV_MODE=false"
-# Host IP for container env vars (FM_P2P_URL, etc.) - detected at startup if unset
-EnvironmentFile=-/etc/archipelago/host-ip.env
-ExecStartPre=/bin/bash -c 'mkdir -p /etc/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk \"{print \\$1}\")" > /etc/archipelago/host-ip.env'
+Environment="ARCHIPELAGO_DEV_MODE=true"
 ExecStart=/usr/local/bin/archipelago
 Restart=on-failure
 RestartSec=5
 
-# Security hardening
-NoNewPrivileges=true
-ProtectSystem=strict
-ReadWritePaths=/var/lib/archipelago
-ProtectHome=true
-PrivateTmp=true
-
 [Install]
 WantedBy=multi-user.target