fix: production onboarding, CI tests, container security, keyboard nav

Install & Onboarding:
- Remove DEV_MODE=true from production ISO service file (auto-created
  users, skipped password setup)
- Auto-install no longer overwrites rootfs service file with bad template
- Login.vue always checks auth.isSetup — shows password creation form
  on fresh install without requiring dev build flag
- Deploy image-versions.sh to /opt/archipelago/scripts/ on installed nodes
- First-boot-containers sources image-versions.sh, runs podman as
  archipelago user (rootless), enables linger + podman.socket
- Correct volume ownership (100000:100000 for rootless UID mapping)

Container Security:
- FileBrowser: add --cap-add=DAC_OVERRIDE for rootless podman volume access
- FileBrowser: add --read-only, /data volume for database, proper cmd args
- First-boot script matches backend config (security hardening + health check)

CI Pipeline:
- Add vue-tsc type check + vitest run to build-iso.yml (runs every push)
- Add post-install-tests.yml workflow (workflow_dispatch, SSH to target)
- Build report: set +eo pipefail, fix rootfs path, add || true guards
- Bundle run-post-install-tests.sh into ISO

E2E Test Suite (scripts/run-post-install-tests.sh):
- Phase 1: Install verification (files, services, podman, linger, DEV_MODE check)
- Phase 2: Onboarding flow (auth.isSetup, auth.setup, login, DID, complete)
- Phase 3: Container lifecycle (install 3 apps via package.install RPC,
  verify running, stop, verify stopped, restart, verify running, health)
- Phase 4: Log verification (first-boot log, diagnostics, journal errors)
- Correct package.install params: {"id", "dockerImage"}

Frontend:
- Fix backdrop-filter tab-switch bug (keep animations paused during rebuild)
- Dashboard glitch animations paused during tab-hidden
- Gamepad nav: auto-focus first container on route change
- Tab roving: Left/Right on role="tab" cycles and activates sibling tabs
- ContainerApps: data-controller-launch on running app cards
- 515 tests passing (fixed 30 broken, added 19 new keyboard nav tests)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso.yml

@@ -24,6 +24,12 @@ jobs:
       - name: Build frontend
         run: cd neode-ui && npm ci && npm run build
 
+      - name: Type check frontend
+        run: cd neode-ui && npx vue-tsc -b --noEmit
+
+      - name: Run frontend tests
+        run: cd neode-ui && npx vitest run
+
       - name: Cache Debian Live ISO
         run: |
           WORK_DIR="image-recipe/build/auto-installer"
@@ -67,6 +73,7 @@ jobs:
         if: always()
         continue-on-error: true
         run: |
+          set +eo pipefail
           echo "══════════════════════════════════════════"
           echo "BUILD REPORT"
           echo "══════════════════════════════════════════"
@@ -80,7 +87,7 @@ jobs:
           ls -lh /var/lib/archipelago/filebrowser/Builds/archipelago-unbundled-*.iso 2>/dev/null | tail -3
           echo ""
           echo "── Rootfs contents check ──"
-          ROOTFS=$(ls image-recipe/build/auto-installer/rootfs.tar 2>/dev/null)
+          ROOTFS=$(ls image-recipe/build/auto-installer/archipelago-rootfs.tar 2>/dev/null) || true
           if [ -n "$ROOTFS" ]; then
             echo "  rootfs.tar: $(sudo du -h "$ROOTFS" 2>/dev/null | cut -f1 || echo 'unknown')"
             echo "  nginx config: $(sudo tar tf "$ROOTFS" ./etc/nginx/sites-available/archipelago 2>/dev/null && echo 'PRESENT' || echo 'MISSING')"
@@ -96,7 +103,7 @@ jobs:
           fi
           echo ""
           echo "── ISO contents check ──"
-          ISO=$(ls image-recipe/results/archipelago-installer-unbundled-*.iso 2>/dev/null | head -1)
+          ISO=$(ls image-recipe/results/archipelago-installer-unbundled-*.iso 2>/dev/null | head -1) || true
           if [ -n "$ISO" ]; then
             echo "  ISO size: $(sudo du -h "$ISO" 2>/dev/null | cut -f1 || echo 'unknown')"
             ISO_MOUNT=$(mktemp -d)

.gitea/workflows/post-install-tests.yml

@@ -0,0 +1,72 @@
+name: Post-Install Tests
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: 'Target node IP (e.g. 192.168.1.198)'
+        required: true
+        default: '192.168.1.198'
+      password:
+        description: 'Node password (or "auto" for fresh install)'
+        required: false
+        default: 'auto'
+
+jobs:
+  post-install-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run post-install tests on target
+        run: |
+          TARGET="${{ github.event.inputs.target }}"
+          PASSWORD="${{ github.event.inputs.password }}"
+          if [ "$PASSWORD" = "auto" ]; then
+            PASSWORD="testpass123!"
+          fi
+
+          echo "══════════════════════════════════════════"
+          echo "Running post-install tests on $TARGET"
+          echo "══════════════════════════════════════════"
+
+          # Copy test script to target and run
+          sshpass -p 'archipelago' scp -o StrictHostKeyChecking=no \
+            scripts/run-post-install-tests.sh \
+            archipelago@${TARGET}:/tmp/run-post-install-tests.sh 2>/dev/null || \
+          scp -o StrictHostKeyChecking=no \
+            scripts/run-post-install-tests.sh \
+            archipelago@${TARGET}:/tmp/run-post-install-tests.sh
+
+          # Run tests (with sudo for service checks)
+          sshpass -p 'archipelago' ssh -o StrictHostKeyChecking=no \
+            archipelago@${TARGET} \
+            "sudo bash /tmp/run-post-install-tests.sh '$PASSWORD'" 2>/dev/null || \
+          ssh -o StrictHostKeyChecking=no \
+            archipelago@${TARGET} \
+            "sudo bash /tmp/run-post-install-tests.sh '$PASSWORD'"
+
+  frontend-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Install dependencies
+        run: cd neode-ui && npm ci
+
+      - name: Type check
+        run: cd neode-ui && npx vue-tsc -b --noEmit
+
+      - name: Run tests
+        run: cd neode-ui && npx vitest run
+
+      - name: Audit dependencies
+        run: cd neode-ui && npm audit --omit=dev