fix: ISO boot, container installs, VPN, nginx, companion input

- LUKS auto-unlock: initramfs hook + systemd service + nofail fstab
- Rootfs packages: add passt, aardvark-dns, netavark, nftables for Podman 5.x
- nginx: resolver + variable proxy_pass for external domains (DNS at boot)
- Boot: loglevel=0 suppresses kernel warnings, serial console for QEMU
- Container installs: write configs before chown, sudo chown for LUKS volumes
- Container installs: build UI sidecars locally (not from registry) for auth injection
- Bitcoin UI: inject RPC auth from secrets file, --no-cache rebuild
- Secrets: chown to archipelago user in first-boot (backend needs read access)
- Podman: image_copy_tmp_dir for read-only /var/tmp in user namespace
- NostrVPN: enable service in auto-install, always include public relays
- NostrVPN: read tunnel IP from nvpn status (not just config file)
- VPN invite: v2 base64 no-pad format matching phone app
- Companion input: relay always active, kiosk skips relay listener (prevents double input)
- dev-start.sh: production build includes AIUI deployment

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/dev-start.sh

@@ -331,6 +331,15 @@ case $choice in
         if npx vue-tsc -b --noEmit 2>&1 | tail -3; then
             npm run build 2>&1 | tail -3
             sudo cp -r "$PROJECT_ROOT/web/dist/neode-ui/"* /opt/archipelago/web-ui/
+            # Deploy AIUI (pre-built demo or source build)
+            if [ -d "$PROJECT_ROOT/../AIUI/packages/app/dist" ]; then
+                sudo cp -r "$PROJECT_ROOT/../AIUI/packages/app/dist/"* /opt/archipelago/web-ui/aiui/
+                echo "   AIUI deployed from source build"
+            elif [ -d "$PROJECT_ROOT/demo/aiui" ]; then
+                sudo mkdir -p /opt/archipelago/web-ui/aiui/
+                sudo cp -r "$PROJECT_ROOT/demo/aiui/"* /opt/archipelago/web-ui/aiui/
+                echo "   AIUI deployed from demo/"
+            fi
             echo "   Frontend deployed to /opt/archipelago/web-ui/"
         else
             echo "   FAILED: vue-tsc type check"