fix: alpha release hardening — onboarding, security, and ISO build

- Convert "Choose Your Path" screen to informative (read-only cards)
- Harden "Choose Your Setup" (gray out Coming Soon options, auto-select Fresh Start)
- Auto-fetch DID on mount with retry and auto-advance after success
- Improve backup download for mobile compatibility
- Add retry logic to verify step with graceful skip option
- Route verify → done → login for complete onboarding flow
- Add AIUI install confirmation via custom event (SEC-001)
- Add file path whitelist for AIUI file access (SEC-002)
- Add log redaction for container logs sent to AIUI (SEC-003)
- Add Secure flag to session cookie in production (SEC-004)
- Fix ISO build script to handle zstd compression errors gracefully
- Sync archipelago.service from live server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -548,8 +548,12 @@ echo "$CONTAINER_IMAGES" | while read -r image filename; do
         echo "   Pulling $image (linux/amd64)..."
         if $CONTAINER_CMD pull --platform linux/amd64 "$image"; then
             echo "   Saving $filename..."
-            $CONTAINER_CMD save "$image" -o "$tarpath"
-            echo "   ✅ Saved: $(du -h "$tarpath" | cut -f1)"
+            if $CONTAINER_CMD save "$image" -o "$tarpath" 2>/dev/null; then
+                echo "   ✅ Saved: $(du -h "$tarpath" | cut -f1)"
+            else
+                echo "   ⚠️  Failed to save $image (zstd/format issue) - skipping"
+                rm -f "$tarpath"
+            fi
         else
             echo "   ⚠️  Failed to pull $image - skipping"
         fi