fix: alpha release hardening — onboarding, security, and ISO build

- Convert "Choose Your Path" screen to informative (read-only cards)
- Harden "Choose Your Setup" (gray out Coming Soon options, auto-select Fresh Start)
- Auto-fetch DID on mount with retry and auto-advance after success
- Improve backup download for mobile compatibility
- Add retry logic to verify step with graceful skip option
- Route verify → done → login for complete onboarding flow
- Add AIUI install confirmation via custom event (SEC-001)
- Add file path whitelist for AIUI file access (SEC-002)
- Add log redaction for container logs sent to AIUI (SEC-003)
- Add Secure flag to session cookie in production (SEC-004)
- Fix ISO build script to handle zstd compression errors gracefully
- Sync archipelago.service from live server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/views/OnboardingDid.vue

@@ -2,36 +2,39 @@
   <div class="min-h-screen flex items-center justify-center p-4">
     <!-- Main Glass Container -->
     <div class="max-w-[800px] w-full relative z-10 path-glass-container">
-      <!-- Header -->
+      <!-- Header (before DID is retrieved) -->
       <div v-if="!generatedDid" class="text-center flex-shrink-0">
         <h1 class="text-[26px] font-semibold text-white/96 mb-6 drop-shadow-[0_2px_6px_rgba(0,0,0,0.4)]">
           Your node's identity
         </h1>
         <p class="text-[20px] text-white/75 leading-relaxed max-w-[600px] mx-auto mb-6">
-          Your node has a Decentralized Identifier (DID) for secure, passwordless authentication. Retrieve it to continue.
+          Your node has a Decentralized Identifier (DID) for secure, passwordless authentication.
         </p>
       </div>
 
       <!-- Content Area -->
       <div class="flex flex-col items-center gap-6 mb-6">
-        <!-- Error message -->
-        <p v-if="errorMessage" class="text-red-400 text-sm mb-4">{{ errorMessage }}</p>
-        <!-- Fetch Button (if no DID yet) -->
-        <button
-          v-if="!generatedDid"
-          @click="fetchDid"
-          :disabled="isGenerating"
-          class="path-action-button path-action-button--continue"
-        >
-          <span v-if="!isGenerating">Retrieve DID</span>
-          <span v-else class="flex items-center gap-2">
-            <svg class="animate-spin h-5 w-5" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24">
+        <!-- Connecting state -->
+        <div v-if="!generatedDid && isGenerating" class="text-center">
+          <div class="flex items-center justify-center gap-3 mb-4">
+            <svg class="animate-spin h-6 w-6 text-white/80" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24">
               <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
               <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
             </svg>
-            Retrieving...
-          </span>
-        </button>
+            <span class="text-lg text-white/80">Connecting to your server...</span>
+          </div>
+        </div>
+
+        <!-- Connection failed - retry -->
+        <div v-if="!generatedDid && !isGenerating && connectionFailed" class="text-center">
+          <p class="text-white/60 text-base mb-4">{{ errorMessage }}</p>
+          <button
+            @click="fetchDid"
+            class="path-action-button path-action-button--continue"
+          >
+            Retry
+          </button>
+        </div>
 
         <!-- Generated DID Display -->
         <div v-if="generatedDid" class="w-full max-w-[600px] space-y-4">
@@ -44,7 +47,8 @@
                 </svg>
               </div>
             </div>
-            <p class="text-[20px] text-white/80 leading-relaxed max-w-[600px] mx-auto mb-6">
+            <p v-if="autoAdvancing" class="text-lg text-white/80 mb-2">DID retrieved, continuing...</p>
+            <p v-else class="text-[20px] text-white/80 leading-relaxed max-w-[600px] mx-auto mb-6">
               Your node's decentralized identifier
             </p>
           </div>
@@ -77,8 +81,7 @@
         <button
           v-if="generatedDid"
           @click="proceed"
-          :disabled="generatedDid.includes('...')"
-          class="path-action-button path-action-button--continue disabled:opacity-50"
+          class="path-action-button path-action-button--continue"
         >
           Continue
         </button>
@@ -95,9 +98,10 @@ import { rpcClient } from '@/api/rpc-client'
 const router = useRouter()
 const generatedDid = ref<string>('')
 const isGenerating = ref(false)
+const connectionFailed = ref(false)
+const autoAdvancing = ref(false)
 const errorMessage = ref<string>('')
 
-/** Store DID state with proper kid (DID#key-1 per W3C) */
 function storeDidState(did: string, pubkey: string) {
   localStorage.setItem('neode_did', did)
   localStorage.setItem('neode_did_state', JSON.stringify({ did, kid: `${did}#key-1`, pubkey }))
@@ -105,6 +109,7 @@ function storeDidState(did: string, pubkey: string) {
 
 async function fetchDid() {
   isGenerating.value = true
+  connectionFailed.value = false
   errorMessage.value = ''
 
   for (let attempt = 0; attempt < 3; attempt++) {
@@ -112,35 +117,42 @@ async function fetchDid() {
       const { did, pubkey } = await rpcClient.getNodeDid()
       generatedDid.value = did
       storeDidState(did, pubkey)
-      break
+      autoAdvanceAfterDelay()
+      isGenerating.value = false
+      return
     } catch (err) {
-      errorMessage.value = err instanceof Error ? err.message : 'Server unavailable. Retrying...'
       if (attempt < 2) {
         await new Promise((r) => setTimeout(r, 1000 * (attempt + 1)))
-      } else {
-        generatedDid.value = 'did:key:z6Mk... (connect to server)'
       }
     }
   }
+
   isGenerating.value = false
+  connectionFailed.value = true
+  errorMessage.value = 'Could not connect to your server. Please check that it is running and try again.'
+}
+
+function autoAdvanceAfterDelay() {
+  autoAdvancing.value = true
+  setTimeout(() => {
+    router.push('/onboarding/backup').catch(() => {})
+  }, 2000)
 }
 
 onMounted(() => {
-  // Auto-fetch if identity may already exist (e.g. returning to this step)
   const cached = localStorage.getItem('neode_did')
   if (cached && !cached.includes('...')) {
     generatedDid.value = cached
+  } else {
+    fetchDid()
   }
 })
 
 function proceed() {
-  if (generatedDid.value && !generatedDid.value.includes('...')) {
-    router.push('/onboarding/backup').catch(() => {})
-  }
+  router.push('/onboarding/backup').catch(() => {})
 }
 
 function skipForNow() {
   router.push('/onboarding/backup').catch(() => {})
 }
 </script>
-