feat: NostrVPN mesh + VPN card UI + nvpn v0.3.7

- VPN card: relay URLs, device management, invite QR, add participant
- Backend: vpn.invite, vpn.add-participant, vpn.peer-config RPCs
- nvpn v0.3.7 system service (fixes event processing bug in v0.3.4)
- First-boot: auto-configure nvpn with node identity and endpoint
- Service: AF_NETLINK for WireGuard, NoNewPrivileges=no for sudo wg
- TASK-50: networking stack reliability from first install

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/archipelago.service

@@ -28,13 +28,14 @@ ProtectHome=no
 # and must be shared between the service and SSH-created containers
 ReadWritePaths=/var/lib/archipelago /etc/containers /var/lib/containers /run/containers /run/user /tmp /home/archipelago/.local/share/containers /home/archipelago/.config/containers /etc
 
-# Privilege restriction — restored with rootless podman (no sudo needed)
-NoNewPrivileges=yes
+# Privilege restriction — NoNewPrivileges=no required for sudo archipelago-wg
+# (WireGuard peer management). Scoped via sudoers to only archipelago-wg.
+NoNewPrivileges=no
 PrivateDevices=no
 SupplementaryGroups=dialout debian-tor
 
-# Network restriction (allow only IPv4/IPv6 + Unix sockets)
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# Network restriction (allow IPv4/IPv6 + Unix sockets + netlink for WireGuard/VPN management)
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 
 # Restrict what the process can do
 # RestrictNamespaces disabled: rootless podman creates user namespaces