fix: alpha release hardening — onboarding, security, and ISO build

- Convert "Choose Your Path" screen to informative (read-only cards)
- Harden "Choose Your Setup" (gray out Coming Soon options, auto-select Fresh Start)
- Auto-fetch DID on mount with retry and auto-advance after success
- Improve backup download for mobile compatibility
- Add retry logic to verify step with graceful skip option
- Route verify → done → login for complete onboarding flow
- Add AIUI install confirmation via custom event (SEC-001)
- Add file path whitelist for AIUI file access (SEC-002)
- Add log redaction for container logs sent to AIUI (SEC-003)
- Add Secure flag to session cookie in production (SEC-004)
- Fix ISO build script to handle zstd compression errors gracefully
- Sync archipelago.service from live server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/views/OnboardingBackup.vue

@@ -112,20 +112,32 @@ async function downloadBackup() {
   try {
     const backupData = await rpcClient.createBackup(passphrase.value)
 
-    const blob = new Blob([JSON.stringify(backupData, null, 2)], {
-      type: 'application/json',
-    })
+    const json = JSON.stringify(backupData, null, 2)
+    const blob = new Blob([json], { type: 'application/json' })
+    const url = URL.createObjectURL(blob)
+
+    // Use a visible link appended to DOM for better mobile compatibility
     const a = document.createElement('a')
-    a.href = URL.createObjectURL(blob)
+    a.href = url
     a.download = 'archipelago-did-backup.json'
+    a.style.display = 'none'
+    document.body.appendChild(a)
     a.click()
-    URL.revokeObjectURL(a.href)
+    // Delay cleanup so mobile browsers can start the download
+    setTimeout(() => {
+      document.body.removeChild(a)
+      URL.revokeObjectURL(url)
+    }, 1000)
 
     downloaded.value = true
     localStorage.setItem('neode_backup_created', '1')
   } catch (err) {
-    errorMessage.value =
-      err instanceof Error ? err.message : 'Failed to create backup. Please try again.'
+    const msg = err instanceof Error ? err.message : String(err)
+    if (/502|503|timeout|fetch|network/i.test(msg)) {
+      errorMessage.value = 'Server is not reachable. Please ensure your node is running and try again.'
+    } else {
+      errorMessage.value = msg || 'Failed to create backup. Please try again.'
+    }
   } finally {
     isDownloading.value = false
   }