fix: unbundled first-boot, fast VPN status, kiosk relay dedup

- Unbundled ISO: first-boot only creates FileBrowser (marker file .unbundled)
  Users install apps from Marketplace — no more bitcoin/mempool on clean install
- VPN status: read tunnel IP from config file (instant) instead of nvpn status (22s)
- Kiosk: App.vue skips remote relay on /kiosk path (prevents duplicate input)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -1150,6 +1150,8 @@ echo ""
 if [ "$UNBUNDLED" = "1" ]; then
     echo "📦 Step 3b: Bundling core containers only (UNBUNDLED mode)"
     echo "   Optional apps will be downloaded on-demand from the Marketplace after install."
+    # Marker file: first-boot-containers.sh checks this to skip app creation
+    touch "$ARCH_DIR/.unbundled"
     IMAGES_DIR="$ARCH_DIR/container-images"
     mkdir -p "$IMAGES_DIR"
     # FileBrowser is a core dependency (powers the Cloud file manager) — always bundle it
@@ -2154,6 +2156,12 @@ if [ -d "$BOOT_MEDIA/archipelago/web-ui" ]; then
     cp -r "$BOOT_MEDIA/archipelago/web-ui" /mnt/target/opt/archipelago/
 fi
 
+# Mark unbundled mode so first-boot only creates FileBrowser (user installs apps from Marketplace)
+if [ -f "$BOOT_MEDIA/archipelago/.unbundled" ]; then
+    touch /mnt/target/opt/archipelago/.unbundled
+    echo "   Unbundled mode: apps install on-demand from Marketplace"
+fi
+
 if [ -d "$BOOT_MEDIA/archipelago/apps" ]; then
     cp -r "$BOOT_MEDIA/archipelago/apps" /mnt/target/etc/archipelago/
 fi