fix(ui): wifi setup on a fresh install — reveal toggle + a no-network callout (#145)

Two reports from a fresh install without a cable:

(a) No way to see the WiFi password being typed. Every password field in
    the app was a bare type=password input. PasswordRevealInput is the
    reusable fix — masked by default, one-tap eye toggle, v-model and
    enter pass-through — first applied to the WiFi prompt in ServerModals
    so a long key typed from across the room can be verified.

(b) WiFi settings are undiscoverable with no wired internet. New
    OnboardingNetworkCallout floats over every onboarding step when the
    node has NO physical link at all (no ethernet up, no WiFi associated
    — polled from network.list-interfaces, self-dismissing the moment a
    link exists) and deep-links 'Connect to WiFi' to
    /dashboard/server?open=wifi, which Server.vue consumes by popping the
    WiFi picker on arrival. Deliberately scoped the other way too:
    Archipelago is offline-first, so 'no internet' never nags — only 'no
    link at all', only during onboarding (the wrapper hosts /login too;
    the callout is restricted to /onboarding/* routes), and a failed probe
    stays silent. The query is consumed via history.replaceState so a
    KeepAlive tab-return never re-pops the modal, and Server.vue keeps
    reading it from the real URL rather than vue-router — its
    KeepAlive-mounted tests have no router context to give.

Verification: full frontend suite 1023/1023; type-check clean; production
build clean with both new strings confirmed in the emitted bundles
(OnboardingWrapper + Server chunks).

neode-ui/src/views/OnboardingWrapper.vue

@@ -48,6 +48,10 @@
     <!-- Content with 3D transitions -->
     <div class="perspective-container-wrapper">
       <div class="perspective-container">
+        <!-- #145: fresh install with no cable — point at the WiFi picker. -->
+        <!-- Onboarding routes only: logged-in sessions are offline-first and
+             must never be nagged about connectivity. -->
+        <OnboardingNetworkCallout v-if="isOnboardingRoute" />
         <RouterView v-slot="{ Component, route }">
           <Transition :name="transitionName">
             <div :key="route.path" class="view-wrapper">
@@ -64,9 +68,15 @@
 import { ref, watch, onMounted, computed } from 'vue'
 import { useRoute } from 'vue-router'
 import { resumeAudioContext, startSynthwave } from '@/composables/useLoginSounds'
+import OnboardingNetworkCallout from '@/components/OnboardingNetworkCallout.vue'
 
 const route = useRoute()
 const currentBackground = ref('bg-intro.jpg')
+
+// #145: the no-network callout follows the user across onboarding steps, but
+// this wrapper also hosts /login (and could host more later) — scope the
+// callout to the onboarding flow only.
+const isOnboardingRoute = computed(() => route.path.startsWith('/onboarding/'))
 const isGlitching = ref(false)
 const isTransitioning = ref(false)
 const videoElement = ref<HTMLVideoElement | null>(null)

neode-ui/src/views/Server.vue

@@ -970,6 +970,7 @@ onUnmounted(() => disarmVpnPoll())
 // outside a <KeepAlive> boundary (confirmed by ServerNetworkRefresh.test.ts,
 // which mounts this view bare), so a bare mount must not silently skip them.
 onMounted(() => {
+  consumeOpenWifiQuery()
   checkTorStatus(); loadNetworkData(); loadInterfaces(); loadTorServices(); loadVpnPeers(); loadFipsSummary(); loadDiskStatus()
   armServerEntryEffects()
 })
@@ -977,6 +978,20 @@ onMounted(() => {
 watch(showWifiModal, (open) => { if (open) scanWifi() })
 watch(showDnsModal, (open) => { if (open) { dnsSelectedProvider.value = networkData.value.dnsProvider || 'system'; dnsError.value = '' } })
 
+// #145: onboarding's no-network callout deep-links here with ?open=wifi so a
+// fresh-install user lands straight in the WiFi picker. Read from the real
+// URL (the dashboard's SPA router keeps it in sync) rather than vue-router —
+// the KeepAlive-mounted view has no router guarantee at test-mount time —
+// and consume it (history.replaceState) so a tab-return never re-pops.
+function consumeOpenWifiQuery() {
+  const params = new URLSearchParams(window.location.search)
+  if (params.get('open') !== 'wifi') return
+  params.delete('open')
+  const qs = params.toString()
+  history.replaceState(history.state, '', window.location.pathname + (qs ? `?${qs}` : '') + window.location.hash)
+  showWifiModal.value = true
+}
+
 async function restartServices() {
   restarting.value = true; servicesRunning.value = false
   try { await rpcClient.restartServer(); logsToast.value = 'Services restarting...'; setTimeout(() => { logsToast.value = '' }, 4000) }

neode-ui/src/views/server/ServerModals.vue

@@ -147,12 +147,12 @@
       <!-- WiFi password prompt -->
       <div v-if="wifiConnecting" class="mt-4 pt-4 border-t border-white/10">
         <p class="text-sm text-white/80 mb-2">Connect to <span class="font-medium text-white">{{ wifiSelectedSsid }}</span></p>
-        <input
+        <PasswordRevealInput
           v-model="localWifiPassword"
-          type="password"
           placeholder="WiFi password"
-          class="w-full px-3 py-2 bg-white/5 border border-white/10 rounded-lg text-white text-sm placeholder-white/30 focus:outline-none focus:border-white/30 mb-3"
-          @keyup.enter="$emit('connectWifi', localWifiPassword)"
+          :disabled="wifiSubmitting"
+          class="mb-3"
+          @enter="$emit('connectWifi', localWifiPassword)"
         />
         <p v-if="wifiError" class="text-sm text-red-400 mb-3">{{ wifiError }}</p>
         <div class="flex gap-2">
@@ -231,6 +231,7 @@
 
 <script setup lang="ts">
 import { ref } from 'vue'
+import PasswordRevealInput from '@/components/PasswordRevealInput.vue'
 
 defineProps<{
   showAddServiceModal: boolean