fix: filebrowser registry, CI cleanup, autologin, auth debug logging

- CI: configure root podman with insecure registry so FileBrowser
  image can be pulled during ISO build
- CI: chmod u+rwX on workspace and act cache to fix cleanup failure
- ISO: auto-login on tty1 (no password prompt on console)
- Frontend: add console.log debug output for onboarding routing,
  health checks, and 401 redirects to diagnose session issues

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/api/rpc-client.ts

@@ -62,10 +62,11 @@ class RPCClient {
           // Use a single shared timeout to prevent redirect storms when
           // multiple parallel requests all get 401 at once
           if (response.status === 401 && method !== 'auth.login') {
-            // Don't redirect during onboarding — those endpoints are unauthenticated
             const isOnboarding = window.location.pathname.startsWith('/onboarding')
+            console.warn(`[RPC] 401 on ${method} | path=${window.location.pathname} | onboarding=${isOnboarding} | redirecting=${RPCClient._sessionExpiredRedirecting}`)
             if (!isOnboarding && !RPCClient._sessionExpiredRedirecting) {
               RPCClient._sessionExpiredRedirecting = true
+              console.warn(`[RPC] Session expired — redirecting to /login in 300ms`)
               setTimeout(() => {
                 window.location.href = '/login'
               }, 300)