release(v1.7.38-alpha): onboarding auto-heal + silent returning logins + app-store trim

- auth.rs now infers onboarding-complete from setup_complete + password_hash so
  nodes stop bouncing users through the intro wizard after browser clear / update
  / reboot; the flag self-heals to disk on next check
- frontend: "backend uncertain" no longer defaults to /onboarding/intro —
  useOnboarding returns null + callers poll / retry instead of flashing the wizard
- login sounds (synthwave, welcome voice, pop, whoosh, oomph) gated by
  isFirstInstallPhase(); typing sounds unaffected
- removed FIPS app, Nostr Relay, Nostr VPN, Routstr, Penpot from catalog,
  frontend config, Rust AppMetadata + install dispatch + install_penpot_stack;
  docker/fips-ui + docker/nostr-vpn-ui + apps/penpot dirs and 5 icons deleted;
  15 image versions deleted from tx1138, .168, gitea-local registries (.160
  Gitea was 502 at release time — follow-up)
- AIUI baked into frontend release tarball via demo/aiui/; deploy-to-target
  falls back to demo/aiui/ when the AIUI sibling checkout is missing
- prebuild hook syncs app-catalog/catalog.json → public/catalog.json so the
  two copies can no longer drift (was the source of the "apps still visible"
  bug — public/ had stale data)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

neode-ui/src/router/index.ts

@@ -311,18 +311,35 @@ router.beforeEach(async (to, _from, next) => {
       next()
       return
     }
-    // Check if this is a fresh install that needs onboarding
+    // Check if this is a fresh install that needs onboarding.
+    // Prefer checkOnboardingStatus() (tri-state) so we can distinguish
+    // "confirmed fresh install" from "backend unreachable". On the
+    // latter, send the user to RootRedirect (/) rather than the intro
+    // wizard — RootRedirect polls the backend and will route to
+    // /login once it answers, instead of forcing a re-onboarding.
     try {
-      const { isOnboardingComplete, getSavedOnboardingStep } = await import('@/composables/useOnboarding')
-      const setupDone = await isOnboardingComplete()
-      if (!setupDone) {
+      const { checkOnboardingStatus, getSavedOnboardingStep } = await import('@/composables/useOnboarding')
+      const setupDone = await checkOnboardingStatus()
+      if (setupDone === false) {
         const step = getSavedOnboardingStep()
         next(`/onboarding/${step}`)
         return
       }
+      if (setupDone === null) {
+        // Backend unreachable after retries — bounce through RootRedirect
+        // so it can keep polling and land the user on /login once the
+        // backend answers, instead of flashing the onboarding wizard.
+        const cached = localStorage.getItem('neode_onboarding_complete') === '1'
+        if (!cached) {
+          next('/')
+          return
+        }
+        // Cached as onboarded — continue to the /login path below.
+      }
     } catch {
-      // If we can't check, assume fresh install and show onboarding
-      next('/onboarding/intro')
+      // Unexpected error — do NOT default to onboarding. Hand off to
+      // RootRedirect which has retry + polling + boot-screen handling.
+      next('/')
       return
     }
     next({ path: '/login', query: { redirect: to.fullPath } })