fix: container installs, Tor, kiosk, GRUB, LUKS display, error messages

Critical:
- fix: container installs fail with "statfs: no such file or directory"
  Root cause: NoNewPrivileges=yes in systemd blocks sudo inside backend.
  Fix: use std::fs::create_dir_all + podman unshare chown (no sudo needed)
- fix: Tor services.json never written — \$ARCHY_TOR_DIR escaping bug
- fix: kiosk white screen — increase health wait to 60s, add --disable-gpu

Improvements:
- feat: LUKS encryption badge in Server disk stats (backend detects dm-crypt)
- fix: GRUB theme text scaling on 4:3 monitors — explicit fonts, wider menu
- fix: suppress default Debian MOTD (custom profile.d welcome is enough)
- fix: install error messages now show "Failed to pull/start" instead of
  generic "Operation failed" (middleware.rs allowlist expanded)
- fix: container-tests CI — source cargo env before running tests
- docs: interactive container architecture diagram (HTML)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/container-tests.yml

@@ -29,6 +29,7 @@ jobs:
       - name: Run orchestration unit tests
         working-directory: core
         run: |
+          source $HOME/.cargo/env 2>/dev/null || true
           echo "=== Container crate tests ==="
           cargo test -p archipelago-container --no-fail-fast 2>&1
 
@@ -38,7 +39,9 @@ jobs:
 
       - name: Verify cargo check (full crate)
         working-directory: core
-        run: cargo check --release 2>&1
+        run: |
+          source $HOME/.cargo/env 2>/dev/null || true
+          cargo check --release 2>&1
 
   smoke-tests:
     runs-on: ubuntu-latest