feat: add container security hardening and Fedimint setup wizard

Add --cap-drop=ALL, --security-opt=no-new-privileges:true to all
non-privileged containers. Per-app capability grants for apps needing
CHOWN/SETUID/SETGID. Read-only root filesystem with tmpfs for
compatible apps (searxng, grafana, uptime-kuma, filebrowser,
photoprism, vaultwarden). Add Fedimint "Create a Community" goal
with 4-step wizard. Fix deploy script cp -rf for audio directory.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/style.css

@@ -180,6 +180,13 @@
     background: transparent;
   }
 
+  /* On mobile, leave room for close button + tab bar below AIUI */
+  @media (max-width: 767px) {
+    .chat-iframe-mobile {
+      padding-bottom: calc(var(--mobile-tab-bar-height, 72px) + 52px);
+    }
+  }
+
   /* Chat placeholder (no AIUI URL) */
   .chat-placeholder {
     flex: 1;
@@ -1175,6 +1182,16 @@ html:has(body.video-background-active)::before {
   background: rgba(0, 0, 0, 0.4);
 }
 
+/* ── Mobile floating back/close button (always 8px above tab bar) ──── */
+.mobile-back-btn {
+  position: fixed;
+  left: 1rem;
+  right: 1rem;
+  bottom: calc(var(--mobile-tab-bar-height, 72px) + 8px);
+  z-index: 40;
+  filter: drop-shadow(0 10px 25px rgba(0, 0, 0, 0.5));
+}
+
 /* ── Cloud Audio Player (mini bar) ──── */
 
 .cloud-audio-player {
@@ -1194,8 +1211,9 @@ html:has(body.video-background-active)::before {
   display: flex;
   align-items: center;
   justify-content: center;
-  width: 2.25rem;
-  height: 2.25rem;
+  width: 2.75rem;
+  height: 2.75rem;
+  min-width: 2.75rem;
   border-radius: 50%;
   background: rgba(255, 255, 255, 0.1);
   border: none;
@@ -1203,6 +1221,7 @@ html:has(body.video-background-active)::before {
   cursor: pointer;
   flex-shrink: 0;
   transition: all 0.15s ease;
+  padding: 0;
 }
 .cloud-audio-player-btn:hover {
   background: rgba(255, 255, 255, 0.2);