fix: BUILD_VERSION from Cargo.toml, kiosk scaling, new apps, Rust warnings

Critical:
- BUILD_VERSION was hardcoded as "1.3.0-alpha" — now reads from Cargo.toml
  This caused ALL ISOs to show v1.3.0 regardless of actual binary version

Kiosk:
- Remove --disable-gpu flags (broke display scaling on some monitors)
- Add --start-fullscreen --window-size for reliable fullscreen

New apps:
- Nostr VPN, FIPS, Routstr, noStrudel, BotFights, NWNN, 484 Kitchen,
  Call the Operator, Arch Presentation, Syntropy Institute, T-0

Rust: suppress dead_code and unused_assignments warnings

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/public/assets/img/app-icons/fips.svg

@@ -0,0 +1,4 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <rect width="64" height="64" rx="12" fill="#10b981"/>
+  <text x="32" y="38" text-anchor="middle" font-family="system-ui" font-size="16" font-weight="700" fill="white">FIPS</text>
+</svg>

neode-ui/public/assets/img/app-icons/nostr-vpn.svg

@@ -0,0 +1,4 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <rect width="64" height="64" rx="12" fill="#6366f1"/>
+  <text x="32" y="38" text-anchor="middle" font-family="system-ui" font-size="18" font-weight="700" fill="white">NV</text>
+</svg>

neode-ui/public/assets/img/app-icons/routstr.svg

@@ -0,0 +1,4 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <rect width="64" height="64" rx="12" fill="#f59e0b"/>
+  <text x="32" y="38" text-anchor="middle" font-family="system-ui" font-size="18" font-weight="700" fill="white">R</text>
+</svg>

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -38,6 +38,7 @@ export const APP_PORTS: Record<string, number> = {
   'fedimintd':     8175,
   'fedimint-gateway': 8176,
   'nostr-rs-relay': 18081,
+  'routstr':       8200,
   'indeedhub':     7777,
   'dwn':           3100,
   'endurain':      8080,
@@ -83,6 +84,7 @@ export const HTTPS_PROXY_PATHS: Record<string, string> = {
   'penpot': '/app/penpot/',
   'grafana': '/app/grafana/',
   'indeedhub': '/app/indeedhub/',
+  'routstr': '/app/routstr/',
 }
 
 /** External HTTPS apps -- always loaded directly */
@@ -100,6 +102,7 @@ export const EXTERNAL_URLS: Record<string, string> = {
 export const APP_TITLES: Record<string, string> = {
   'bitcoin-knots': 'Bitcoin', 'btcpay-server': 'BTCPay Server', 'indeedhub': 'Indeehub',
   'botfights': 'BotFights', '484-kitchen': '484 Kitchen', 'arch-presentation': 'Presentation',
+  'nostr-vpn': 'Nostr VPN', 'fips': 'FIPS', 'routstr': 'Routstr',
   'homeassistant': 'Home Assistant', 'uptime-kuma': 'Uptime Kuma',
   'nginx-proxy-manager': 'Nginx Proxy Manager', 'nostr-rs-relay': 'Nostr Relay',
   'call-the-operator': 'Call The Operator', 'syntropy-institute': 'Syntropy Institute',
@@ -120,6 +123,7 @@ export const NEW_TAB_APPS = new Set([
   'onlyoffice',
   'nginx-proxy-manager',
   'tailscale',
+  'routstr',
 ])
 
 /** Sites known to block iframes -- skip the timeout and go straight to fallback */

neode-ui/src/views/appSession/useAppIdentity.ts

@@ -15,7 +15,7 @@ export interface SelectedIdentity {
 }
 
 function isIdentityAwareApp(id: string): boolean {
-  return id === 'indeedhub' || id === 'nostrudel'
+  return id === 'indeedhub' || id === 'nostrudel' || id === 'routstr'
 }
 
 export function useAppIdentity(

neode-ui/src/views/apps/appsConfig.ts

@@ -39,6 +39,7 @@ export const APP_CATEGORY_MAP: Record<string, string> = {
   'homeassistant': 'home', 'lorabell': 'home', 'endurain': 'home',
   'searxng': 'community', 'ollama': 'community', 'grafana': 'data',
   'nostr-rs-relay': 'nostr', 'nostrudel': 'nostr',
+  'nostr-vpn': 'networking', 'fips': 'networking', 'routstr': 'community',
   'tailscale': 'networking', 'nginx-proxy-manager': 'networking', 'portainer': 'networking',
   'uptime-kuma': 'networking', 'dwn': 'data',
   'botfights': 'l484', 'nwnn': 'l484', '484-kitchen': 'l484',
@@ -103,7 +104,7 @@ export const WEB_ONLY_APPS: Record<string, PackageDataEntry> = {
 export const TAB_LAUNCH_APPS = new Set([
   'btcpay-server', 'grafana', 'photoprism', 'homeassistant',
   'vaultwarden', 'nextcloud', 'uptime-kuma', 'portainer',
-  'cryptpad', 'nginx-proxy-manager', 'tailscale',
+  'cryptpad', 'nginx-proxy-manager', 'tailscale', 'routstr',
 ])
 
 export function opensInTab(id: string): boolean {

neode-ui/src/views/discover/curatedApps.ts

@@ -29,6 +29,9 @@ export function getCuratedAppList(): MarketplaceApp[] {
     { id: 'nostr-rs-relay', title: 'Nostr Relay', version: '0.9.0', category: 'nostr', description: 'Your own Nostr relay. Store events locally, relay for friends, publish over Tor.', icon: '/assets/img/app-icons/nostr-rs-relay.svg', author: 'scsiblade', dockerImage: `${R}/nostr-rs-relay:0.9.0`, repoUrl: 'https://sr.ht/~gheartsfield/nostr-rs-relay/' },
     { id: 'indeedhub', title: 'Indeehub', version: '0.1.0', description: 'Bitcoin documentary streaming with Nostr identity. Stream sovereignty content.', icon: '/assets/img/app-icons/indeedhub.png', author: 'Indeehub Team', dockerImage: 'localhost/indeedhub:latest', repoUrl: 'https://github.com/indeedhub/indeedhub' },
     { id: 'dwn', title: 'Decentralized Web Node', version: '0.4.0', description: 'Own your data with DID-based access control. Sync across devices, sovereign.', icon: '/assets/img/app-icons/dwn.svg', author: 'TBD', dockerImage: `${R}/dwn-server:main`, repoUrl: 'https://github.com/TBD54566975/dwn-server' },
+    { id: 'nostr-vpn', title: 'Nostr VPN', version: '0.3.4', category: 'networking', description: 'Tailscale-style mesh VPN with Nostr control plane. Peer discovery and key exchange over relays, WireGuard tunnels.', icon: '/assets/img/app-icons/nostr-vpn.svg', author: 'Martti Malmi', dockerImage: `${R}/nostr-vpn:v0.3.4`, repoUrl: 'https://github.com/mmalmi/nostr-vpn' },
+    { id: 'fips', title: 'FIPS', version: '0.1.0', category: 'networking', description: 'Free Internetworking Peering System. Self-organizing encrypted mesh network with Nostr identity.', icon: '/assets/img/app-icons/fips.svg', author: 'Jim Corgan', dockerImage: `${R}/fips:v0.1.0`, repoUrl: 'https://github.com/jmcorgan/fips' },
+    { id: 'routstr', title: 'Routstr', version: '0.4.3', category: 'community', description: 'Decentralized AI inference proxy. Pay-per-request with Cashu ecash, provider discovery via Nostr.', icon: '/assets/img/app-icons/routstr.svg', author: 'Routstr', dockerImage: `${R}/routstr:v0.4.3`, repoUrl: 'https://github.com/routstr/routstr-core' },
     { id: 'nostrudel', title: 'noStrudel', version: '0.40.0', category: 'nostr', description: 'Feature-rich Nostr web client. Browse feeds, post notes, manage relays with NIP-07.', icon: '/assets/img/app-icons/nostrudel.svg', author: 'hzrd149', dockerImage: '', repoUrl: 'https://github.com/hzrd149/nostrudel', webUrl: 'https://nostrudel.ninja' },
     { id: 'botfights', title: 'BotFights', version: '1.0.0', description: 'AI bot arena — build, train, and battle autonomous agents in strategy tournaments.', icon: '/assets/img/app-icons/botfights.svg', author: 'BotFights', dockerImage: '', repoUrl: 'https://botfights.net', webUrl: 'https://botfights.net' },
     { id: 'nwnn', title: 'Next Web News Network', version: '1.0.0', category: 'l484', description: 'Decentralized news aggregator. Community-curated Bitcoin and sovereignty content.', icon: '/assets/img/app-icons/nwnn.png', author: 'L484', dockerImage: '', repoUrl: 'https://nwnn.l484.com', webUrl: 'https://nwnn.l484.com' },
@@ -58,6 +61,9 @@ export const INSTALLED_ALIASES: Record<string, string[]> = {
   filebrowser: ['filebrowser'],
   tailscale: ['tailscale'],
   ollama: ['ollama'],
+  'nostr-vpn': ['nostr-vpn'],
+  fips: ['fips'],
+  routstr: ['routstr'],
 }
 
 export const FEATURED_DEFINITIONS = [

neode-ui/src/views/marketplace/marketplaceData.ts

@@ -54,6 +54,9 @@ export const INSTALLED_ALIASES: Record<string, string[]> = {
   filebrowser: ['filebrowser'],
   tailscale: ['tailscale'],
   ollama: ['ollama'],
+  'nostr-vpn': ['nostr-vpn'],
+  fips: ['fips'],
+  routstr: ['routstr'],
 }
 
 /** Get app tier classification (matches backend get_app_tier) */
@@ -402,6 +405,42 @@ export function getCuratedAppList(): MarketplaceApp[] {
       manifestUrl: undefined,
       repoUrl: 'https://github.com/TBD54566975/dwn-server'
     },
+    {
+      id: 'nostr-vpn',
+      title: 'Nostr VPN',
+      version: '0.3.4',
+      category: 'networking',
+      description: 'Tailscale-style mesh VPN with Nostr control plane. Peer discovery and key exchange over relays, WireGuard tunnels.',
+      icon: '/assets/img/app-icons/nostr-vpn.svg',
+      author: 'Martti Malmi',
+      dockerImage: `${REGISTRY}/nostr-vpn:v0.3.4`,
+      manifestUrl: undefined,
+      repoUrl: 'https://github.com/mmalmi/nostr-vpn'
+    },
+    {
+      id: 'fips',
+      title: 'FIPS',
+      version: '0.1.0',
+      category: 'networking',
+      description: 'Free Internetworking Peering System. Self-organizing encrypted mesh network with Nostr identity.',
+      icon: '/assets/img/app-icons/fips.svg',
+      author: 'Jim Corgan',
+      dockerImage: `${REGISTRY}/fips:v0.1.0`,
+      manifestUrl: undefined,
+      repoUrl: 'https://github.com/jmcorgan/fips'
+    },
+    {
+      id: 'routstr',
+      title: 'Routstr',
+      version: '0.4.3',
+      category: 'community',
+      description: 'Decentralized AI inference proxy. Pay-per-request with Cashu ecash, provider discovery via Nostr.',
+      icon: '/assets/img/app-icons/routstr.svg',
+      author: 'Routstr',
+      dockerImage: `${REGISTRY}/routstr:v0.4.3`,
+      manifestUrl: undefined,
+      repoUrl: 'https://github.com/routstr/routstr-core'
+    },
     {
       id: 'nostrudel',
       title: 'noStrudel',