fix: container installs, Tor, kiosk, GRUB, LUKS display, error messages

Critical:
- fix: container installs fail with "statfs: no such file or directory"
  Root cause: NoNewPrivileges=yes in systemd blocks sudo inside backend.
  Fix: use std::fs::create_dir_all + podman unshare chown (no sudo needed)
- fix: Tor services.json never written — \$ARCHY_TOR_DIR escaping bug
- fix: kiosk white screen — increase health wait to 60s, add --disable-gpu

Improvements:
- feat: LUKS encryption badge in Server disk stats (backend detects dm-crypt)
- fix: GRUB theme text scaling on 4:3 monitors — explicit fonts, wider menu
- fix: suppress default Debian MOTD (custom profile.d welcome is enough)
- fix: install error messages now show "Failed to pull/start" instead of
  generic "Operation failed" (middleware.rs allowlist expanded)
- fix: container-tests CI — source cargo env before running tests
- docs: interactive container architecture diagram (HTML)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -1158,7 +1158,7 @@ LOG="/var/log/archipelago-tor.log"
 mkdir -p "$ARCHY_TOR_DIR"
 
 # Write services.json for the backend to read
-cat > "\$ARCHY_TOR_DIR/services.json" <<TORJSON
+cat > "$ARCHY_TOR_DIR/services.json" <<TORJSON
 {
   "services": [
     {"name": "archipelago", "local_port": 80, "enabled": true},
@@ -1947,7 +1947,7 @@ if [ -t 0 ] && [ -z "$ARCHIPELAGO_WELCOMED" ]; then
     else
         echo -e "  ${OD}Waiting for network...${N}"
     fi
-    if [ -b /dev/mapper/archipelago-data ]; then
+    if [ -b /dev/mapper/archipelago-data ] || [ -b /dev/mapper/archipelago_crypt ]; then
         echo -e "  ${OD}storage   LUKS2 encrypted${N}"
     fi
     if systemctl is-active archipelago-kiosk.service >/dev/null 2>&1; then
@@ -1960,6 +1960,10 @@ fi
 PROFILE
 chmod +x /mnt/target/etc/profile.d/archipelago.sh
 
+# Suppress default Debian MOTD (our profile.d script handles the welcome)
+echo -n > /mnt/target/etc/motd
+rm -f /mnt/target/etc/motd.d/* 2>/dev/null || true
+
 # Ensure reboot/shutdown work without sudo for the archipelago user
 # profile.d only runs for login shells; .bashrc handles SSH interactive sessions
 if ! grep -q '/sbin' /mnt/target/home/archipelago/.bashrc 2>/dev/null; then
@@ -2088,14 +2092,14 @@ while true; do
         --disable-translate \
         --no-first-run \
         --check-for-update-interval=31536000 \
-        --disable-features=TranslateUI \
+        --disable-features=TranslateUI,PasswordManagerOnboarding,AutofillServerCommunication,PasswordManagerEnabled \
         --disable-session-crashed-bubble \
         --disable-save-password-bubble \
         --disable-suggestions-service \
         --password-store=basic \
-        --disable-features=TranslateUI,PasswordManagerOnboarding,AutofillServerCommunication,PasswordManagerEnabled \
         --disable-component-update \
         --credentials_enable_service=false \
+        --disable-gpu \
         --user-data-dir=/home/archipelago/.config/chromium-kiosk
     sleep 3
 done
@@ -2113,9 +2117,9 @@ ConditionPathExists=/usr/local/bin/archipelago-kiosk-launcher
 
 [Service]
 Type=simple
-ExecStartPre=/bin/bash -c 'for i in $(seq 1 15); do curl -sf http://localhost/health >/dev/null 2>&1 && exit 0; sleep 2; done; exit 0'
+ExecStartPre=/bin/bash -c 'for i in $(seq 1 30); do curl -sf http://localhost/health >/dev/null 2>&1 && exit 0; sleep 2; done; exit 0'
 ExecStart=/usr/local/bin/archipelago-kiosk-launcher
-TimeoutStartSec=60
+TimeoutStartSec=90
 Restart=always
 RestartSec=5
 
@@ -2692,7 +2696,7 @@ set default=0
 
 # Load font for graphical menu
 if loadfont ($root)/boot/grub/font.pf2; then
-    set gfxmode=1024x768,auto
+    set gfxmode=auto
     insmod gfxterm
     insmod png
     terminal_output gfxterm