feat: add container security hardening and Fedimint setup wizard

Add --cap-drop=ALL, --security-opt=no-new-privileges:true to all
non-privileged containers. Per-app capability grants for apps needing
CHOWN/SETUID/SETGID. Read-only root filesystem with tmpfs for
compatible apps (searxng, grafana, uptime-kuma, filebrowser,
photoprism, vaultwarden). Add Fedimint "Create a Community" goal
with 4-step wizard. Fix deploy script cp -rf for audio directory.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/data/goals.ts

@@ -189,6 +189,48 @@ export const GOALS: GoalDefinition[] = [
     estimatedTime: '~40 min + sync time',
     difficulty: 'intermediate',
   },
+  {
+    id: 'setup-fedimint',
+    title: 'Create a Community',
+    subtitle: 'Start a Fedimint federation for private, scalable Bitcoin',
+    icon: 'community',
+    category: 'community',
+    requiredApps: ['bitcoin-knots', 'fedimint'],
+    steps: [
+      {
+        id: 'install-bitcoin',
+        title: 'Install Bitcoin Node',
+        description: 'Bitcoin Knots provides the base layer that Fedimint connects to for on-chain transactions and consensus.',
+        appId: 'bitcoin-knots',
+        action: 'install',
+        isAutomatic: true,
+      },
+      {
+        id: 'install-fedimint',
+        title: 'Install Fedimint',
+        description: 'Fedimint is a federated Bitcoin mint. Guardians collectively manage funds using threshold signatures — no single point of failure.',
+        appId: 'fedimint',
+        action: 'install',
+        isAutomatic: true,
+      },
+      {
+        id: 'configure-guardian',
+        title: 'Set Up Guardian UI',
+        description: 'Open the Guardian UI (port 8175) to configure your federation name, set the guardian threshold, and initialize the mint.',
+        action: 'configure',
+        isAutomatic: false,
+      },
+      {
+        id: 'share-invite',
+        title: 'Share Invite Code',
+        description: 'Generate and share your federation invite code with community members so they can join and start using ecash.',
+        action: 'info',
+        isAutomatic: false,
+      },
+    ],
+    estimatedTime: '~30 min + sync time',
+    difficulty: 'intermediate',
+  },
   {
     id: 'create-identity',
     title: 'Create My Identity',