fix: ISO build freshness, WireGuard startup, VPN status, kiosk remote doubling

- ISO builder: run npm ci before npm run build to prevent stale UI artifacts
- Unbundled ISO: clean container-images dir to prevent bundled tars leaking
- WireGuard: use After=network.target instead of network-online.target for
  faster wg0 startup on install
- VPN status: check actual nvpn0 interface instead of config tunnel_ip to
  prevent NostrVPN from showing standalone WireGuard IP
- ContainerApps: filter out not-installed bundled apps (fixes Bitcoin Knots
  appearing on clean unbundled installs)
- Kiosk: persist kiosk mode to localStorage before /kiosk redirect so
  App.vue can skip remote relay (fixes input doubling with companion app)
- IndeedHub: fix port mapping and X-Forwarded-Prefix passthrough

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/App.vue

@@ -104,7 +104,8 @@ watch(() => appStore.isAuthenticated, (authenticated) => {
     screensaverStore.resetInactivityTimer()
     // Don't start relay on kiosk — kiosk gets input via xdotool (system-level),
     // relay would duplicate every keystroke/click as DOM events
-    const isKiosk = window.location.pathname.startsWith('/kiosk')
+    const isKiosk = localStorage.getItem('kiosk') === 'true'
+      || new URLSearchParams(window.location.search).has('kiosk')
     if (!isKiosk) {
       startRemoteRelay()
     }