feat: add container security hardening and Fedimint setup wizard

Add --cap-drop=ALL, --security-opt=no-new-privileges:true to all
non-privileged containers. Per-app capability grants for apps needing
CHOWN/SETUID/SETGID. Read-only root filesystem with tmpfs for
compatible apps (searxng, grafana, uptime-kuma, filebrowser,
photoprism, vaultwarden). Add Fedimint "Create a Community" goal
with 4-step wizard. Fix deploy script cp -rf for audio directory.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/views/Chat.vue

@@ -1,6 +1,6 @@
 <template>
   <div class="chat-fullscreen">
-    <!-- Close button + connection indicator (desktop only) -->
+    <!-- Close button + connection indicator (desktop: top-right pill) -->
     <div class="chat-mode-pill hidden md:flex">
       <button class="chat-close-btn" @click="closeChat">
         <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -15,18 +15,6 @@
       />
     </div>
 
-    <!-- Mobile close button (bottom, thumb-reachable) -->
-    <button
-      class="md:hidden fixed left-4 right-4 z-40 glass-button px-6 py-3 rounded-lg font-medium shadow-2xl flex items-center justify-center gap-2"
-      :style="{ bottom: bottomPosition, filter: 'drop-shadow(0 10px 25px rgba(0, 0, 0, 0.5))' }"
-      @click="closeChat"
-    >
-      <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
-      </svg>
-      Close Chat
-    </button>
-
     <!-- Loading indicator while iframe loads -->
     <Transition name="fade">
       <div v-if="aiuiUrl && !aiuiConnected" class="chat-loading">
@@ -37,12 +25,12 @@
       </div>
     </Transition>
 
-    <!-- AIUI iframe -->
+    <!-- AIUI iframe — on mobile, leave room for close bar + tab bar at bottom -->
     <iframe
       v-if="aiuiUrl"
       ref="aiuiFrame"
       :src="aiuiUrl"
-      class="chat-iframe"
+      class="chat-iframe chat-iframe-mobile"
       sandbox="allow-scripts allow-same-origin allow-forms"
       allow="microphone"
       style="background: transparent"
@@ -65,6 +53,20 @@
         </p>
       </div>
     </div>
+
+    <!-- Mobile close bar: sits above the tab bar, below the AIUI content -->
+    <div class="md:hidden mobile-back-btn flex items-center justify-center">
+      <button
+        class="w-full glass-button px-6 py-2.5 rounded-lg font-medium flex items-center justify-center gap-2 text-sm"
+        style="background: rgba(0, 0, 0, 0.5); backdrop-filter: blur(18px); -webkit-backdrop-filter: blur(18px);"
+        @click="closeChat"
+      >
+        <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+        </svg>
+        Close Chat
+      </button>
+    </div>
   </div>
 </template>
 
@@ -72,9 +74,7 @@
 import { ref, computed, onMounted, onBeforeUnmount } from 'vue'
 import { useRouter } from 'vue-router'
 import { ContextBroker } from '@/services/contextBroker'
-import { useMobileBackButton } from '@/composables/useMobileBackButton'
 
-const { bottomPosition } = useMobileBackButton()
 const router = useRouter()
 const aiuiFrame = ref<HTMLIFrameElement | null>(null)
 const aiuiConnected = ref(false)