fix: AIUI /aiui/ base path, nginx alias cycle, VPN auth, container boot

- AIUI: rebuild with /aiui/ base path (router, chunk loader, SW scope)
- nginx: remove alias from /aiui/ location (caused try_files redirect cycle)
- VPN: WireGuard standalone setup, auth improvements
- ISO: build script hardening, service file updates
- first-boot-containers: networking stack fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/nginx-archipelago.conf

@@ -21,8 +21,6 @@ server {
 
     # AIUI SPA (Chat mode iframe) — SPA fallback for client-side routing
     location /aiui/ {
-        alias /opt/archipelago/web-ui/aiui/;
-        index index.html;
         try_files $uri $uri/ /aiui/index.html;
         add_header Cache-Control "no-cache, no-store, must-revalidate";
     }
@@ -794,8 +792,6 @@ server {
 
     # AIUI SPA (Chat mode iframe) — SPA fallback for client-side routing
     location /aiui/ {
-        alias /opt/archipelago/web-ui/aiui/;
-        index index.html;
         try_files $uri $uri/ /aiui/index.html;
         add_header Cache-Control "no-cache, no-store, must-revalidate";
     }