fix: RC feedback round 2 — kiosk staleness, LND icon+retry, mesh detection surfacing

Kiosk (backgrounds + FIPS mismatch, one root cause each):
- kiosk service now also waits for the web-ui asset swap (probes a large
  bg asset, bounded 60s) — it launched mid-rsync and CSS background 404s
  are never refetched, hence blank backgrounds on first boot
- FipsNetworkCard polls every 15s instead of fetching once on mount
- PWA updates auto-apply on the kiosk (localStorage kiosk flag) — an
  unattended kiosk could never click 'Update Now' and ran stale bundles

LND App Store:
- catalog icon pointed at lnd.svg which doesn't exist (lnd.png does);
  store card also retries the sibling extension before the placeholder
- image pulls retry once after fast transient failures (<30s) — fresh
  first-boot networks reset connections; slow failures aren't retried
  so the UI never waits longer than before

Mesh detection:
- mesh.status now always reports device_present + detected_devices
  (previously only when the service wasn't running, so the UI couldn't
  tell 'no radio' from 'radio present, session connecting')
- Mesh page shows 'Mesh device detected' badge + 'Device detected —
  connecting' status for present-but-not-connected radios
- the 99-mesh-radio.rules udev rule was never staged into the ISO tree
  (installer searched for it and found nothing) — ship it at the media
  root and install it from install-to-disk.sh too

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

image-recipe/_archived/build-auto-installer-iso.sh

@@ -1569,6 +1569,13 @@ chmod +x "$WORK_DIR/first-boot-secrets.sh"
 cp "$WORK_DIR/first-boot-secrets.sh" "$ARCH_DIR/scripts/"
 cp "$WORK_DIR/archipelago-first-boot-secrets.service" "$ARCH_DIR/scripts/"
 
+# Ship the mesh-radio udev rule at the media root — the embedded installer
+# searches "$BOOT_MEDIA/99-mesh-radio.rules" first, but nothing ever staged
+# the rule into the ISO tree, so installed nodes never got /dev/mesh-radio
+if [ -f "$SCRIPT_DIR/../configs/99-mesh-radio.rules" ]; then
+    cp "$SCRIPT_DIR/../configs/99-mesh-radio.rules" "$INSTALLER_ISO/99-mesh-radio.rules"
+fi
+
 # Tor setup: copy torrc and create first-boot setup script
 mkdir -p "$ARCH_DIR/scripts/tor"
 if [ -f "$SCRIPT_DIR/../../scripts/tor/torrc.template" ]; then

image-recipe/archipelago-scripts/install-to-disk.sh

@@ -278,6 +278,17 @@ if [ -n "$BOOT_MEDIA" ]; then
         mkdir -p /mnt/archipelago/etc/archipelago
         cp -r "$BOOT_MEDIA/archipelago/apps" /mnt/archipelago/etc/archipelago/
     fi
+
+    # Mesh radio udev rule: stable /dev/mesh-radio symlink + dialout perms
+    # for known LoRa USB-serial chips (this installer never shipped it)
+    for p in "$BOOT_MEDIA/99-mesh-radio.rules" "$BOOT_MEDIA/archipelago/configs/99-mesh-radio.rules"; do
+        if [ -f "$p" ]; then
+            mkdir -p /mnt/archipelago/etc/udev/rules.d
+            cp "$p" /mnt/archipelago/etc/udev/rules.d/99-mesh-radio.rules
+            chmod 644 /mnt/archipelago/etc/udev/rules.d/99-mesh-radio.rules
+            break
+        fi
+    done
     
     # Create profile.d script for welcome message on login
     mkdir -p /mnt/archipelago/etc/profile.d

image-recipe/configs/archipelago-kiosk.service

@@ -15,6 +15,13 @@ Type=simple
 # slow-but-functional hardware enough headroom; TimeoutStartSec is
 # bumped in lockstep so systemd doesn't kill us mid-wait.
 ExecStartPre=/bin/bash -c 'for i in $(seq 1 150); do curl -sf http://localhost/health >/dev/null 2>&1 && break; sleep 2; done'
+# Also wait for the web-ui asset swap to finish. The first-boot rsync into
+# /opt/archipelago/web-ui is non-atomic and writes the large bg-*.webp images
+# last — a kiosk launched mid-swap rendered the UI with blank backgrounds
+# (CSS background-image 404s are never refetched). A representative large
+# asset answering 200 means the swap is effectively done. Bounded 60s so a
+# renamed asset can never block kiosk startup.
+ExecStartPre=/bin/bash -c 'for i in $(seq 1 30); do curl -sf -o /dev/null http://localhost/assets/img/bg-home.webp && break; sleep 2; done; exit 0'
 ExecStart=/usr/local/bin/archipelago-kiosk-launcher
 TimeoutStartSec=360
 Restart=always