fix: container installs, Tor, kiosk, GRUB, LUKS display, error messages

Critical:
- fix: container installs fail with "statfs: no such file or directory"
  Root cause: NoNewPrivileges=yes in systemd blocks sudo inside backend.
  Fix: use std::fs::create_dir_all + podman unshare chown (no sudo needed)
- fix: Tor services.json never written — \$ARCHY_TOR_DIR escaping bug
- fix: kiosk white screen — increase health wait to 60s, add --disable-gpu

Improvements:
- feat: LUKS encryption badge in Server disk stats (backend detects dm-crypt)
- fix: GRUB theme text scaling on 4:3 monitors — explicit fonts, wider menu
- fix: suppress default Debian MOTD (custom profile.d welcome is enough)
- fix: install error messages now show "Failed to pull/start" instead of
  generic "Operation failed" (middleware.rs allowlist expanded)
- fix: container-tests CI — source cargo env before running tests
- docs: interactive container architecture diagram (HTML)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/views/Server.vue

@@ -1,6 +1,12 @@
 <template>
   <div class="pb-6">
 
+    <!-- LUKS Encryption Badge -->
+    <div v-if="diskEncrypted" class="mb-4 px-4 py-2.5 rounded-xl border bg-green-500/5 border-green-500/20 flex items-center gap-2.5">
+      <svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 text-green-400 shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z" /></svg>
+      <span class="text-xs text-green-300/80 font-medium">LUKS2 Encrypted Storage</span>
+    </div>
+
     <!-- Disk Space Warning Banner -->
     <div
       v-if="diskWarning"
@@ -391,10 +397,17 @@ async function connectToWifi(password: string) {
 
 // Disk space
 const diskWarning = ref<{ level: 'warning' | 'critical'; used_percent: number; free_bytes: number } | null>(null)
+const diskEncrypted = ref(false)
 const diskCleaning = ref(false)
 
 async function loadDiskStatus() {
-  try { const res = await rpcClient.diskStatus(); if (res.level === 'warning' || res.level === 'critical') { diskWarning.value = { level: res.level, used_percent: res.used_percent, free_bytes: res.free_bytes } } else { diskWarning.value = null } } catch { /* non-critical */ }
+  try {
+    const res = await rpcClient.diskStatus()
+    diskEncrypted.value = !!(res as Record<string, unknown>).encrypted
+    if (res.level === 'warning' || res.level === 'critical') {
+      diskWarning.value = { level: res.level, used_percent: res.used_percent, free_bytes: res.free_bytes }
+    } else { diskWarning.value = null }
+  } catch { /* non-critical */ }
 }
 
 async function runDiskCleanup() {