fix: filebrowser port bind, CSRF in tests, console-setup, auto-test scope

FileBrowser crash fix:
- Add --cap-add=NET_BIND_SERVICE (port 80 needs it with --cap-drop=ALL)
- Add --cap-add=DAC_OVERRIDE for rootless volume access
- Both in first-boot script and backend config.rs

Test script fixes:
- Extract csrf_token cookie and send as X-CSRF-Token header on RPC calls
- Add --phase1-only flag for safe install-only checks (no side effects)
- Auto-test service uses --phase1-only so it doesn't steal onboarding

Install fixes:
- Pre-create ~/.local/share/containers (ReadWritePaths mount namespace error)
- Fix console-setup.service: add After=tmp.mount + ExecStartPre mkdir /tmp

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -961,6 +961,7 @@ if ! runuser -u archipelago -- bash -c 'export XDG_RUNTIME_DIR=/run/user/1000 &&
     runuser -u archipelago -- bash -c "export XDG_RUNTIME_DIR=/run/user/1000 && podman run -d --name filebrowser --restart unless-stopped \
         --cap-drop=ALL \
         --cap-add=DAC_OVERRIDE \
+        --cap-add=NET_BIND_SERVICE \
         --security-opt=no-new-privileges:true \
         --read-only \
         --tmpfs=/tmp:rw,noexec,nosuid,size=64m \
@@ -1364,8 +1365,12 @@ cat > /mnt/target/etc/hosts <<EOF
 EOF
 chmod 644 /mnt/target/etc/hosts
 
-# Configure Archipelago app registry (HTTP, insecure)
+# Pre-create container storage dirs (ReadWritePaths needs these to exist)
+mkdir -p /mnt/target/home/archipelago/.local/share/containers
 mkdir -p /mnt/target/home/archipelago/.config/containers
+chown -R 1000:1000 /mnt/target/home/archipelago/.local
+
+# Configure Archipelago app registry (HTTP, insecure)
 cat > /mnt/target/home/archipelago/.config/containers/registries.conf <<'REGCONF'
 [[registry]]
 location = "80.71.235.15:3000"
@@ -1998,6 +2003,17 @@ chroot /mnt/target systemctl enable archipelago-setup-tor.service 2>/dev/null ||
 chroot /mnt/target systemctl enable archipelago-first-boot-containers.service 2>/dev/null || true
 chroot /mnt/target systemctl enable archipelago-kiosk.service 2>/dev/null || true
 
+# Fix console-setup: setupcon needs /tmp writable, add ordering dependency
+mkdir -p /mnt/target/etc/systemd/system/console-setup.service.d
+cat > /mnt/target/etc/systemd/system/console-setup.service.d/fix-tmp.conf <<'CONSOLEFIX'
+[Unit]
+After=tmp.mount systemd-tmpfiles-setup.service
+Wants=tmp.mount
+
+[Service]
+ExecStartPre=/bin/mkdir -p /tmp
+CONSOLEFIX
+
 # Auto-login on tty1 — no password prompt on console
 mkdir -p /mnt/target/etc/systemd/system/getty@tty1.service.d
 cat > /mnt/target/etc/systemd/system/getty@tty1.service.d/autologin.conf <<'AUTOLOGIN'
@@ -2007,24 +2023,23 @@ ExecStart=-/sbin/agetty --autologin archipelago --noclear %I $TERM
 AUTOLOGIN
 chroot /mnt/target systemctl enable archipelago-diagnostics.service 2>/dev/null || true
 
-# Post-install test runner — runs once on first boot after all services are up
+# Post-install smoke test — runs Phase 1 (install verification) only on first boot
+# Does NOT run onboarding or create passwords — lets user do that via the UI
 cat > /mnt/target/etc/systemd/system/archipelago-post-install-tests.service <<'PITSERVICE'
 [Unit]
-Description=Archipelago Post-Install Test Suite (first boot)
+Description=Archipelago Install Verification (first boot)
 After=archipelago.service archipelago-first-boot-containers.service nginx.service
 Wants=archipelago.service nginx.service
-ConditionPathExists=/opt/archipelago/scripts/run-post-install-tests.sh
 ConditionPathExists=!/var/lib/archipelago/.post-install-tests-done
 
 [Service]
 Type=oneshot
-# Wait for backend to fully initialize
 ExecStartPre=/bin/bash -c 'for i in $(seq 1 30); do curl -sf http://127.0.0.1:5678/health >/dev/null 2>&1 && exit 0; sleep 2; done; exit 0'
-ExecStart=/bin/bash -c '/opt/archipelago/scripts/run-post-install-tests.sh "password123" 2>&1 | tee /var/log/archipelago-post-install-tests.log; touch /var/lib/archipelago/.post-install-tests-done'
+ExecStart=/bin/bash -c '/opt/archipelago/scripts/run-post-install-tests.sh --phase1-only 2>&1 | tee /var/log/archipelago-post-install-tests.log; touch /var/lib/archipelago/.post-install-tests-done'
 RemainAfterExit=yes
 StandardOutput=journal+console
 StandardError=journal+console
-TimeoutStartSec=300
+TimeoutStartSec=120
 
 [Install]
 WantedBy=multi-user.target