release(v1.7.38-alpha): onboarding auto-heal + silent returning logins + app-store trim

- auth.rs now infers onboarding-complete from setup_complete + password_hash so
  nodes stop bouncing users through the intro wizard after browser clear / update
  / reboot; the flag self-heals to disk on next check
- frontend: "backend uncertain" no longer defaults to /onboarding/intro —
  useOnboarding returns null + callers poll / retry instead of flashing the wizard
- login sounds (synthwave, welcome voice, pop, whoosh, oomph) gated by
  isFirstInstallPhase(); typing sounds unaffected
- removed FIPS app, Nostr Relay, Nostr VPN, Routstr, Penpot from catalog,
  frontend config, Rust AppMetadata + install dispatch + install_penpot_stack;
  docker/fips-ui + docker/nostr-vpn-ui + apps/penpot dirs and 5 icons deleted;
  15 image versions deleted from tx1138, .168, gitea-local registries (.160
  Gitea was 502 at release time — follow-up)
- AIUI baked into frontend release tarball via demo/aiui/; deploy-to-target
  falls back to demo/aiui/ when the AIUI sibling checkout is missing
- prebuild hook syncs app-catalog/catalog.json → public/catalog.json so the
  two copies can no longer drift (was the source of the "apps still visible"
  bug — public/ had stale data)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -24,7 +24,6 @@ export const APP_PORTS: Record<string, number> = {
   'searxng':       8888,
   'ollama':        11434,
   'onlyoffice':    8044,
-  'penpot':        9001,
   'nextcloud':     8085,
   'vaultwarden':   8082,
   'jellyfin':      8096,
@@ -38,10 +37,6 @@ export const APP_PORTS: Record<string, number> = {
   'fedimint':      8175,
   'fedimintd':     8175,
   'fedimint-gateway': 8176,
-  'nostr-rs-relay': 18081,
-  'nostr-vpn':     8201,
-  'fips':          8202,
-  'routstr':       8200,
   'indeedhub':     7778,
   'botfights':     9100,
   'gitea':         3000,
@@ -87,14 +82,10 @@ export const HTTPS_PROXY_PATHS: Record<string, string> = {
   'dwn': '/app/dwn/',
   'btcpay-server': '/app/btcpay/',
   'nextcloud': '/app/nextcloud/',
-  'penpot': '/app/penpot/',
   'grafana': '/app/grafana/',
   'indeedhub': '/app/indeedhub/',
   'botfights': '/app/botfights/',
   'gitea': '/app/gitea/',
-  'routstr': '/app/routstr/',
-  'nostr-vpn': '/app/nostr-vpn/',
-  'fips': '/app/fips/',
 }
 
 /** External HTTPS apps -- always loaded directly */
@@ -112,9 +103,8 @@ export const APP_TITLES: Record<string, string> = {
   'bitcoin-knots': 'Bitcoin Knots', 'bitcoin-core': 'Bitcoin Core',
   'btcpay-server': 'BTCPay Server', 'indeedhub': 'Indeehub',
   'botfights': 'BotFights', 'gitea': 'Gitea', '484-kitchen': '484 Kitchen', 'arch-presentation': 'Presentation',
-  'nostr-vpn': 'Nostr VPN', 'fips': 'FIPS', 'routstr': 'Routstr',
   'homeassistant': 'Home Assistant', 'uptime-kuma': 'Uptime Kuma',
-  'nginx-proxy-manager': 'Nginx Proxy Manager', 'nostr-rs-relay': 'Nostr Relay',
+  'nginx-proxy-manager': 'Nginx Proxy Manager',
   'call-the-operator': 'Call The Operator', 'syntropy-institute': 'Syntropy Institute',
   't-zero': 'T-Zero', 'nostrudel': 'noStrudel',
 }
@@ -128,12 +118,10 @@ export const NEW_TAB_APPS = new Set([
   'vaultwarden',
   'nextcloud',
   'uptime-kuma',
-  'penpot',
   'portainer',
   'onlyoffice',
   'nginx-proxy-manager',
   'tailscale',
-  'routstr',
 ])
 
 /** Sites known to block iframes -- skip the timeout and go straight to fallback */