fix: AIUI /aiui/ base path, nginx alias cycle, VPN auth, container boot

- AIUI: rebuild with /aiui/ base path (router, chunk loader, SW scope)
- nginx: remove alias from /aiui/ location (caused try_files redirect cycle)
- VPN: WireGuard standalone setup, auth improvements
- ISO: build script hardening, service file updates
- first-boot-containers: networking stack fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/configs/nostr-vpn.service

@@ -2,6 +2,8 @@
 Description=Nostr VPN - Mesh VPN with Nostr identity
 After=network-online.target tor.service archipelago.service
 Wants=network-online.target
+StartLimitIntervalSec=300
+StartLimitBurst=10
 
 [Service]
 Type=simple
@@ -13,8 +15,6 @@ ExecStartPre=/bin/bash -c 'test -f /var/lib/archipelago/nostr-vpn/env || { echo
 ExecStart=/usr/local/bin/nvpn daemon
 Restart=on-failure
 RestartSec=30
-StartLimitIntervalSec=300
-StartLimitBurst=10
 TimeoutStartSec=30
 TimeoutStopSec=10