fix: ISO build freshness, WireGuard startup, VPN status, kiosk remote doubling

- ISO builder: run npm ci before npm run build to prevent stale UI artifacts
- Unbundled ISO: clean container-images dir to prevent bundled tars leaking
- WireGuard: use After=network.target instead of network-online.target for
  faster wg0 startup on install
- VPN status: check actual nvpn0 interface instead of config tunnel_ip to
  prevent NostrVPN from showing standalone WireGuard IP
- ContainerApps: filter out not-installed bundled apps (fixes Bitcoin Knots
  appearing on clean unbundled installs)
- Kiosk: persist kiosk mode to localStorage before /kiosk redirect so
  App.vue can skip remote relay (fixes input doubling with companion app)
- IndeedHub: fix port mapping and X-Forwarded-Prefix passthrough

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -1076,6 +1076,8 @@ if [ "$WEBUI_CAPTURED" = "0" ]; then
         echo "   ⚠️  Could not capture from live server, building from source..."
     fi
     cd "$SCRIPT_DIR/../neode-ui"
+    echo "   Installing frontend dependencies..."
+    npm ci --prefer-offline 2>&1 | tail -3
     if npm run build 2>&1 | tail -5; then
         if [ -d "$SCRIPT_DIR/../web/dist/neode-ui" ]; then
             echo "   Including web UI from web/dist/neode-ui..."
@@ -1153,6 +1155,8 @@ if [ "$UNBUNDLED" = "1" ]; then
     # Marker file: first-boot-containers.sh checks this to skip app creation
     touch "$ARCH_DIR/.unbundled"
     IMAGES_DIR="$ARCH_DIR/container-images"
+    # Clean stale images from previous builds (e.g. bundled build tars leaking into unbundled)
+    rm -rf "$IMAGES_DIR"
     mkdir -p "$IMAGES_DIR"
     # FileBrowser is a core dependency (powers the Cloud file manager) — always bundle it
     CORE_IMAGE="${FILEBROWSER_IMAGE}"

image-recipe/configs/archipelago-wg.service

@@ -1,7 +1,6 @@
 [Unit]
 Description=Archipelago Standalone WireGuard (wg0)
-After=network-online.target
-Wants=network-online.target
+After=network.target
 ConditionPathExists=/var/lib/archipelago/wireguard/private.key
 
 [Service]