feat: container orchestration, branding overhaul, onboarding logging

Container orchestration:
- Health monitor with crash recovery and auto-restart
- Doctor service (periodic health checks via systemd timer)
- Reconcile service (desired-state convergence)
- Stack-aware install/uninstall with dependency tracking

Branding:
- Custom GRUB background (designer artwork, 1024x768)
- ISOLINUX boot menu: centered, orange accents, clean labels
- Terminal banners: adaptive width, basic ANSI colors, fits 80-col
- Removed auto-generated splash scripts (designer provides assets)
- GRUB theme: lowercase branding

Frontend:
- 401 handler clears localStorage immediately (prevents cascade)

Backend:
- Onboarding/auth logging ([onboarding] tag in journalctl)
- Cookie Secure flag logging for debugging HTTP/HTTPS issues

ISO fixes:
- Install log saved before unmount (was silently failing)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/crash_recovery.rs

@@ -384,6 +384,36 @@ fn container_boot_tier(name: &str) -> u8 {
     }
 }
 
+/// Run the reconciliation script after boot to fix any config drift.
+/// Ensures all containers match their canonical specs from container-specs.sh.
+pub async fn run_boot_reconciliation() {
+    let script = "/home/archipelago/archy/scripts/reconcile-containers.sh";
+    if !std::path::Path::new(script).exists() {
+        info!("Reconciliation script not found (dev mode?) — skipping boot reconciliation");
+        return;
+    }
+    info!("Running boot reconciliation...");
+    let result = tokio::time::timeout(
+        std::time::Duration::from_secs(300),
+        tokio::process::Command::new(script).output(),
+    )
+    .await;
+    match result {
+        Ok(Ok(output)) if output.status.success() => {
+            info!("Boot reconciliation complete");
+        }
+        Ok(Ok(output)) => {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            warn!(
+                "Boot reconciliation had failures: {}",
+                stderr.chars().take(500).collect::<String>()
+            );
+        }
+        Ok(Err(e)) => warn!("Boot reconciliation failed to run: {}", e),
+        Err(_) => warn!("Boot reconciliation timed out (300s)"),
+    }
+}
+
 /// Spawn a background task that periodically saves the container snapshot.
 pub fn spawn_snapshot_task(data_dir: PathBuf) {
     tokio::spawn(async move {