fix: deploy error visibility, trap cleanup, variable quoting, frontend resilience

- S10: Add warnings to silent health check failures in deploy scripts
- S11: Add trap cleanup for temp dirs in deploy and tailscale scripts
- S12: Quote 20+ critical unquoted variables across deploy scripts
- S13: Extract hardcoded IPs to deploy-config-defaults.sh
- S15: Add --memory=256m to UI container runs
- F16: Remove in-memory JWT, use cookie-only auth in filebrowser client
- F17: Add meta tag fallback for CSRF token in RPC client
- F19: Track and clear setTimeout in AppSession on unmount

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/views/AppSession.vue

@@ -226,6 +226,7 @@ const showModeMenu = ref(false)
 const autoRetryCount = ref(0)
 let loadTimeoutId: ReturnType<typeof setTimeout> | null = null
 let autoRetryId: ReturnType<typeof setTimeout> | null = null
+let iframeCheckId: ReturnType<typeof setTimeout> | null = null
 
 /** Sites known to block iframes — skip the timeout and go straight to fallback */
 const IFRAME_BLOCKED_APPS = new Set<string>([])
@@ -504,7 +505,7 @@ function onLoad() {
   isRefreshing.value = false
   autoRetryCount.value = 0
   // Check if iframe actually loaded content (same-origin only)
-  setTimeout(() => {
+  iframeCheckId = setTimeout(() => {
     try {
       const doc = iframeRef.value?.contentDocument
       if (doc) {
@@ -699,6 +700,7 @@ onMounted(() => {
 onBeforeUnmount(() => {
   if (loadTimeoutId) clearTimeout(loadTimeoutId)
   if (autoRetryId) clearTimeout(autoRetryId)
+  if (iframeCheckId) clearTimeout(iframeCheckId)
   window.removeEventListener('keydown', onKeyDown, true)
   window.removeEventListener('message', onMessage)
   document.removeEventListener('click', onClickOutside)