release(v1.7.38-alpha): onboarding auto-heal + silent returning logins + app-store trim

- auth.rs now infers onboarding-complete from setup_complete + password_hash so
  nodes stop bouncing users through the intro wizard after browser clear / update
  / reboot; the flag self-heals to disk on next check
- frontend: "backend uncertain" no longer defaults to /onboarding/intro —
  useOnboarding returns null + callers poll / retry instead of flashing the wizard
- login sounds (synthwave, welcome voice, pop, whoosh, oomph) gated by
  isFirstInstallPhase(); typing sounds unaffected
- removed FIPS app, Nostr Relay, Nostr VPN, Routstr, Penpot from catalog,
  frontend config, Rust AppMetadata + install dispatch + install_penpot_stack;
  docker/fips-ui + docker/nostr-vpn-ui + apps/penpot dirs and 5 icons deleted;
  15 image versions deleted from tx1138, .168, gitea-local registries (.160
  Gitea was 502 at release time — follow-up)
- AIUI baked into frontend release tarball via demo/aiui/; deploy-to-target
  falls back to demo/aiui/ when the AIUI sibling checkout is missing
- prebuild hook syncs app-catalog/catalog.json → public/catalog.json so the
  two copies can no longer drift (was the source of the "apps still visible"
  bug — public/ had stale data)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

neode-ui/src/stores/appLauncher.ts

@@ -41,7 +41,6 @@ const PORT_TO_APP_ID: Record<string, string> = {
   '8334': 'bitcoin-knots',
   '8888': 'searxng',
   '9000': 'portainer',
-  '9001': 'penpot',
   '9980': 'onlyoffice',
   '11434': 'ollama',
   '2283': 'immich',
@@ -51,7 +50,6 @@ const PORT_TO_APP_ID: Record<string, string> = {
   '8175': 'fedimint',
   '8176': 'fedimint-gateway',
   '3100': 'dwn',
-  '18081': 'nostr-rs-relay',
   '7777': 'indeedhub',
   '50002': 'electrumx',
   '3010': 'thunderhub',