fix: AIUI /aiui/ base path, nginx alias cycle, VPN auth, container boot

- AIUI: rebuild with /aiui/ base path (router, chunk loader, SW scope)
- nginx: remove alias from /aiui/ location (caused try_files redirect cycle)
- VPN: WireGuard standalone setup, auth improvements
- ISO: build script hardening, service file updates
- first-boot-containers: networking stack fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/archipelago.service

@@ -34,15 +34,12 @@ NoNewPrivileges=no
 PrivateDevices=no
 SupplementaryGroups=dialout debian-tor
 
-# Network restriction (allow IPv4/IPv6 + Unix sockets + netlink for WireGuard/VPN management)
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
-
-# Restrict what the process can do
-# RestrictNamespaces disabled: rootless podman creates user namespaces
-RestrictRealtime=yes
-
-# SystemCallFilter disabled: rootless podman needs clone/unshare for user namespaces
-SystemCallArchitectures=native
+# Network, syscall, and realtime restrictions DISABLED on Debian 12:
+# RestrictAddressFamilies, SystemCallArchitectures, and RestrictRealtime all use
+# seccomp filters that force no_new_privs=1 in the kernel (systemd 252).
+# This blocks sudo, which is required for archipelago-wg (WireGuard peer management).
+# Debian 13+ (systemd 256) respects NoNewPrivileges=no as an override, but Debian 12 does not.
+# Re-enable these when dropping Debian 12 support.
 
 # MemoryDenyWriteExecute removed: ring (rustls) and secp256k1 (bitcoin/nostr)
 # use assembly code that requires executable memory mappings on some platforms