feat: add container security hardening and Fedimint setup wizard

Add --cap-drop=ALL, --security-opt=no-new-privileges:true to all
non-privileged containers. Per-app capability grants for apps needing
CHOWN/SETUID/SETGID. Read-only root filesystem with tmpfs for
compatible apps (searxng, grafana, uptime-kuma, filebrowser,
photoprism, vaultwarden). Add Fedimint "Create a Community" goal
with 4-step wizard. Fix deploy script cp -rf for audio directory.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/types/goals.ts

@@ -5,7 +5,7 @@ export interface GoalDefinition {
   title: string
   subtitle: string
   icon: string
-  category: 'commerce' | 'payments' | 'storage' | 'identity' | 'network' | 'backup'
+  category: 'commerce' | 'payments' | 'storage' | 'identity' | 'network' | 'backup' | 'community'
   requiredApps: string[]
   steps: GoalStep[]
   estimatedTime: string