fix: AIUI /aiui/ base path, nginx alias cycle, VPN auth, container boot

- AIUI: rebuild with /aiui/ base path (router, chunk loader, SW scope)
- nginx: remove alias from /aiui/ location (caused try_files redirect cycle)
- VPN: WireGuard standalone setup, auth improvements
- ISO: build script hardening, service file updates
- first-boot-containers: networking stack fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/archipelago/src/api/rpc/vpn.rs

@@ -36,7 +36,8 @@ impl RpcHandler {
             Err(_) => None,
         };
 
-        let node_npub = vpn::read_nvpn_config_value("nostr", "public_key").await;
+        let node_npub = vpn::read_nvpn_config_value("nostr", "public_key").await
+            .map(|k| vpn::ensure_npub(&k));
         let (relay_onion, relay_direct) = vpn::get_relay_urls().await;
         // Prefer onion (always works), fall back to direct IP
         let relay_url = relay_onion.clone().or(relay_direct.clone());
@@ -260,9 +261,10 @@ impl RpcHandler {
             }
         }
 
-        // Read nvpn config to build invite
+        // Read nvpn config to build invite (convert hex to npub1 if needed)
         let npub = vpn::read_nvpn_config_value("nostr", "public_key").await
-            .ok_or_else(|| anyhow::anyhow!("No Nostr public key in nvpn config"))?;
+            .map(|k| vpn::ensure_npub(&k))
+            .ok_or_else(|| anyhow::anyhow!("No Nostr public key in nvpn config — VPN not configured"))?;
         // network_id is in [[networks]] array — read first entry
         let network_id = vpn::read_nvpn_config_list_entry("networks", "network_id").await
             .unwrap_or_else(|| "nostr-vpn".to_string());