feat: add container security hardening and Fedimint setup wizard

Add --cap-drop=ALL, --security-opt=no-new-privileges:true to all
non-privileged containers. Per-app capability grants for apps needing
CHOWN/SETUID/SETGID. Read-only root filesystem with tmpfs for
compatible apps (searxng, grafana, uptime-kuma, filebrowser,
photoprism, vaultwarden). Add Fedimint "Create a Community" goal
with 4-step wizard. Fix deploy script cp -rf for audio directory.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/views/AppDetails.vue

@@ -9,13 +9,9 @@
     </button>
 
     <!-- Mobile Full-Width Back Button -->
-    <button 
+    <button
       @click="goBack"
-      class="md:hidden fixed left-4 right-4 z-40 glass-button px-6 py-3 rounded-lg font-medium shadow-2xl flex items-center justify-center gap-2"
-      :style="{
-        bottom: bottomPosition,
-        filter: 'drop-shadow(0 10px 25px rgba(0, 0, 0, 0.5))'
-      }"
+      class="md:hidden mobile-back-btn glass-button px-6 py-3 rounded-lg font-medium shadow-2xl flex items-center justify-center gap-2"
     >
       <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
         <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 19l-7-7 7-7" />
@@ -432,12 +428,9 @@ import { useRouter, useRoute } from 'vue-router'
 import { useAppStore } from '../stores/app'
 import { useAppLauncherStore } from '../stores/appLauncher'
 import { PackageState } from '../types/api'
-import { useMobileBackButton } from '../composables/useMobileBackButton'
 import { useModalKeyboard } from '@/composables/useModalKeyboard'
 import { dummyApps } from '../utils/dummyApps'
 
-const { bottomPosition } = useMobileBackButton()
-
 const router = useRouter()
 const route = useRoute()
 const store = useAppStore()

neode-ui/src/views/Chat.vue

@@ -1,6 +1,6 @@
 <template>
   <div class="chat-fullscreen">
-    <!-- Close button + connection indicator (desktop only) -->
+    <!-- Close button + connection indicator (desktop: top-right pill) -->
     <div class="chat-mode-pill hidden md:flex">
       <button class="chat-close-btn" @click="closeChat">
         <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -15,18 +15,6 @@
       />
     </div>
 
-    <!-- Mobile close button (bottom, thumb-reachable) -->
-    <button
-      class="md:hidden fixed left-4 right-4 z-40 glass-button px-6 py-3 rounded-lg font-medium shadow-2xl flex items-center justify-center gap-2"
-      :style="{ bottom: bottomPosition, filter: 'drop-shadow(0 10px 25px rgba(0, 0, 0, 0.5))' }"
-      @click="closeChat"
-    >
-      <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
-      </svg>
-      Close Chat
-    </button>
-
     <!-- Loading indicator while iframe loads -->
     <Transition name="fade">
       <div v-if="aiuiUrl && !aiuiConnected" class="chat-loading">
@@ -37,12 +25,12 @@
       </div>
     </Transition>
 
-    <!-- AIUI iframe -->
+    <!-- AIUI iframe — on mobile, leave room for close bar + tab bar at bottom -->
     <iframe
       v-if="aiuiUrl"
       ref="aiuiFrame"
       :src="aiuiUrl"
-      class="chat-iframe"
+      class="chat-iframe chat-iframe-mobile"
       sandbox="allow-scripts allow-same-origin allow-forms"
       allow="microphone"
       style="background: transparent"
@@ -65,6 +53,20 @@
         </p>
       </div>
     </div>
+
+    <!-- Mobile close bar: sits above the tab bar, below the AIUI content -->
+    <div class="md:hidden mobile-back-btn flex items-center justify-center">
+      <button
+        class="w-full glass-button px-6 py-2.5 rounded-lg font-medium flex items-center justify-center gap-2 text-sm"
+        style="background: rgba(0, 0, 0, 0.5); backdrop-filter: blur(18px); -webkit-backdrop-filter: blur(18px);"
+        @click="closeChat"
+      >
+        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+        </svg>
+        Close Chat
+      </button>
+    </div>
   </div>
 </template>
 
@@ -72,9 +74,7 @@
 import { ref, computed, onMounted, onBeforeUnmount } from 'vue'
 import { useRouter } from 'vue-router'
 import { ContextBroker } from '@/services/contextBroker'
-import { useMobileBackButton } from '@/composables/useMobileBackButton'
 
-const { bottomPosition } = useMobileBackButton()
 const router = useRouter()
 const aiuiFrame = ref<HTMLIFrameElement | null>(null)
 const aiuiConnected = ref(false)

neode-ui/src/views/CloudFolder.vue

@@ -160,12 +160,10 @@ import { ref, computed, watch } from 'vue'
 import { useRouter, useRoute, RouterLink } from 'vue-router'
 import { useAppStore } from '../stores/app'
 import { useCloudStore } from '../stores/cloud'
-import { useMobileBackButton } from '../composables/useMobileBackButton'
 import CloudToolbar from '../components/cloud/CloudToolbar.vue'
 import FileGrid from '../components/cloud/FileGrid.vue'
 import { useAudioPlayer } from '../composables/useAudioPlayer'
 
-useMobileBackButton()
 const router = useRouter()
 const route = useRoute()
 const store = useAppStore()

neode-ui/src/views/Dashboard.vue

@@ -286,12 +286,11 @@
 
     <!-- Mobile Bottom Tab Bar - glass piece 5 -->
     <nav
-      v-show="!chatFullscreen"
       ref="mobileTabBar"
       data-mobile-tab-bar
       class="md:hidden fixed bottom-0 left-0 right-0 border-t border-glass-border shadow-glass z-50 glass-piece"
       :class="{ 'glass-throw-tabbar': showZoomIn }"
-      style="background: rgba(0, 0, 0, 0.25); backdrop-filter: blur(18px); -webkit-backdrop-filter: blur(18px);"
+      style="background: rgba(0, 0, 0, 0.25); backdrop-filter: blur(18px); -webkit-backdrop-filter: blur(18px); padding-bottom: env(safe-area-inset-bottom, 0px);"
     >
       <div class="flex justify-around items-center px-2 py-3 relative">
         <RouterLink