fix: ISO build freshness, WireGuard startup, VPN status, kiosk remote doubling

- ISO builder: run npm ci before npm run build to prevent stale UI artifacts
- Unbundled ISO: clean container-images dir to prevent bundled tars leaking
- WireGuard: use After=network.target instead of network-online.target for
  faster wg0 startup on install
- VPN status: check actual nvpn0 interface instead of config tunnel_ip to
  prevent NostrVPN from showing standalone WireGuard IP
- ContainerApps: filter out not-installed bundled apps (fixes Bitcoin Knots
  appearing on clean unbundled installs)
- Kiosk: persist kiosk mode to localStorage before /kiosk redirect so
  App.vue can skip remote relay (fixes input doubling with companion app)
- IndeedHub: fix port mapping and X-Forwarded-Prefix passthrough

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/router/index.ts

@@ -87,6 +87,11 @@ const router = createRouter({
       path: '/kiosk',
       name: 'kiosk',
       redirect: '/',
+      beforeEnter: () => {
+        // Persist kiosk mode before redirect so App.vue can skip the remote relay
+        // (relay duplicates xdotool input on the kiosk display)
+        localStorage.setItem('kiosk', 'true')
+      },
     },
     {
       path: '/dashboard',