fix: AIUI /aiui/ base path, nginx alias cycle, VPN auth, container boot

- AIUI: rebuild with /aiui/ base path (router, chunk loader, SW scope)
- nginx: remove alias from /aiui/ location (caused try_files redirect cycle)
- VPN: WireGuard standalone setup, auth improvements
- ISO: build script hardening, service file updates
- first-boot-containers: networking stack fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/archipelago/src/api/rpc/auth.rs

@@ -32,6 +32,26 @@ impl RpcHandler {
         }
 
         tracing::info!("[onboarding] login successful");
+
+        // Ensure NostrVPN config exists — covers the case where onboardingComplete
+        // was never called (e.g., user took the "already set up" shortcut).
+        let data_dir = self.config.data_dir.clone();
+        tokio::spawn(async move {
+            // Quick check: if config.toml already exists, skip
+            let config_path = data_dir.join("nostr-vpn/.config/nvpn/config.toml");
+            if config_path.exists() {
+                return;
+            }
+            // Identity must exist for VPN config
+            if !data_dir.join("identity/nostr_pubkey").exists() {
+                return;
+            }
+            match crate::vpn::configure_nostr_vpn(&data_dir).await {
+                Ok(()) => tracing::info!("[login] NostrVPN auto-configured on first login"),
+                Err(e) => tracing::debug!("[login] NostrVPN auto-config skipped: {}", e),
+            }
+        });
+
         Ok(serde_json::Value::Null)
     }
 

core/archipelago/src/api/rpc/vpn.rs

@@ -36,7 +36,8 @@ impl RpcHandler {
             Err(_) => None,
         };
 
-        let node_npub = vpn::read_nvpn_config_value("nostr", "public_key").await;
+        let node_npub = vpn::read_nvpn_config_value("nostr", "public_key").await
+            .map(|k| vpn::ensure_npub(&k));
         let (relay_onion, relay_direct) = vpn::get_relay_urls().await;
         // Prefer onion (always works), fall back to direct IP
         let relay_url = relay_onion.clone().or(relay_direct.clone());
@@ -260,9 +261,10 @@ impl RpcHandler {
             }
         }
 
-        // Read nvpn config to build invite
+        // Read nvpn config to build invite (convert hex to npub1 if needed)
         let npub = vpn::read_nvpn_config_value("nostr", "public_key").await
-            .ok_or_else(|| anyhow::anyhow!("No Nostr public key in nvpn config"))?;
+            .map(|k| vpn::ensure_npub(&k))
+            .ok_or_else(|| anyhow::anyhow!("No Nostr public key in nvpn config — VPN not configured"))?;
         // network_id is in [[networks]] array — read first entry
         let network_id = vpn::read_nvpn_config_list_entry("networks", "network_id").await
             .unwrap_or_else(|| "nostr-vpn".to_string());