fix: auth, container resilience, ISO build, gamepad polish

- fix: login disconnect — verify session before WebSocket connect
- fix: 403 on app install — distinguish CSRF vs RBAC errors, only retry CSRF
- fix: health monitor now watches ALL containers (removed skip list for
  backend services like nbxplorer, databases, UI containers)
- fix: server.get-state added to CSRF-exempt list (read-only)
- fix: ISO build includes container-specs.sh and lib/common.sh in rootfs
  so reconcile actually works on fresh installs
- fix: gamepad nav — improved Server tab zone nav, focus styles, autofocus
- chore: move L484 web-only apps to Services tab
- chore: install store for cross-view install tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/views/settings/ChangePasswordSection.vue

@@ -76,7 +76,7 @@ function closeChangePasswordModal() {
 
 <template>
   <!-- Change Password -->
-  <div data-controller-container tabindex="0" class="mb-6">
+  <div class="mb-6">
     <button
       ref="changePasswordRestoreFocusRef"
       @click="showChangePasswordModal = true"