fix: auth, container resilience, ISO build, gamepad polish

- fix: login disconnect — verify session before WebSocket connect
- fix: 403 on app install — distinguish CSRF vs RBAC errors, only retry CSRF
- fix: health monitor now watches ALL containers (removed skip list for
  backend services like nbxplorer, databases, UI containers)
- fix: server.get-state added to CSRF-exempt list (read-only)
- fix: ISO build includes container-specs.sh and lib/common.sh in rootfs
  so reconcile actually works on fresh installs
- fix: gamepad nav — improved Server tab zone nav, focus styles, autofocus
- chore: move L484 web-only apps to Services tab
- chore: install store for cross-view install tracking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/stores/auth.ts

@@ -32,7 +32,15 @@ export const useAuthStore = defineStore('auth', () => {
       // Initialize data structure immediately so dashboard can render
       await sync.initializeData()
 
-      // Connect WebSocket in background - don't block login flow
+      // Verify session cookies are established before WebSocket connect.
+      // Without this, the WS upgrade can race ahead of cookie processing → 401.
+      try {
+        await rpcClient.call({ method: 'server.echo', params: { message: 'session-ready' } })
+      } catch {
+        // Non-fatal: WS reconnect logic will handle it
+      }
+
+      // Connect WebSocket in background
       sync.connectWebSocket().catch((err) => {
         if (import.meta.env.DEV) console.warn('[Store] WebSocket connection failed after login, will retry:', err)
       })
@@ -52,6 +60,14 @@ export const useAuthStore = defineStore('auth', () => {
 
     const sync = useSyncStore()
     await sync.initializeData()
+
+    // Verify session cookies are established before WebSocket connect
+    try {
+      await rpcClient.call({ method: 'server.echo', params: { message: 'session-ready' } })
+    } catch {
+      // Non-fatal: WS reconnect logic will handle it
+    }
+
     sync.connectWebSocket().catch((err) => {
       if (import.meta.env.DEV) console.warn('[Store] WebSocket connection failed after TOTP login, will retry:', err)
     })