feat: NostrVPN as native system service, Claude API key input, fix duplicate password

- Add NostrVPN as a native systemd service (extracted from container)
- Add VPN status detection for nostr-vpn in backend vpn.rs
- ISO build extracts nvpn binary from container image
- First-boot auto-configures NostrVPN with node's Nostr identity
- Change Claude Auth from login iframe to API key input field
- Remove duplicate ChangePasswordSection from Settings.vue
- FIPS and Routstr remain as installable container apps

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/first-boot-containers.sh

@@ -86,6 +86,26 @@ done
 chown -R archipelago:archipelago "$TOR_HOSTNAMES" 2>/dev/null
 log "Tor hostnames populated: $(ls $TOR_HOSTNAMES 2>/dev/null | tr '\n' ' ')"
 
+# ── NostrVPN: configure native system service with node identity ──────
+if command -v nvpn >/dev/null 2>&1; then
+  NOSTR_SECRET=$(cat /var/lib/archipelago/identity/nostr_secret 2>/dev/null)
+  NOSTR_PUBKEY=$(cat /var/lib/archipelago/identity/nostr_pubkey 2>/dev/null)
+  if [ -n "$NOSTR_SECRET" ]; then
+    mkdir -p /var/lib/archipelago/nostr-vpn
+    cat > /var/lib/archipelago/nostr-vpn/env <<NVPNENV
+NOSTR_SECRET=${NOSTR_SECRET}
+NOSTR_PUBKEY=${NOSTR_PUBKEY}
+NVPNENV
+    chmod 600 /var/lib/archipelago/nostr-vpn/env
+    systemctl enable --now nostr-vpn 2>/dev/null || true
+    log "NostrVPN configured with node identity and started"
+  else
+    log "NostrVPN: no Nostr identity yet — will configure after onboarding"
+  fi
+else
+  log "NostrVPN binary not found — skipping VPN setup"
+fi
+
 # Wait for a container to be healthy (accepting connections)
 wait_for_container() {
   local name="$1" check_cmd="$2" max_wait="${3:-30}"