feat: rootless podman, session hardening, boot stability, sidebar fix

Rootless podman migration (TASK-11):
- Remove sudo from all podman calls in PodmanClient + 8 backend files
- Remove sudo from all podman/docker calls in deploy script
- Restore full systemd security hardening: NoNewPrivileges,
  RestrictAddressFamilies, MemoryDenyWriteExecute, RestrictRealtime,
  RestrictNamespaces, RestrictSUIDSGID, SystemCallFilter, ProtectSystem=strict
- Enable loginctl linger for rootless container persistence
- Remove Ollama from auto-deploy (marketplace-only)

Session & auth hardening:
- Increase MAX_CONCURRENT_SESSIONS 20→50 (prevents eviction storms)
- Debounced 401 redirect in rpc-client.ts (prevents redirect storms)

Boot stability:
- optimize-debian.sh: adds chrony, swap, removes policy-rc.d
- deploy script: pre-restart chrony + swap setup
- ISO build: chrony package, swap file creation
- BootScreen: no longer clears localStorage (prevents splash replay)
- RootRedirect: sole owner of localStorage clearing on server ready

UI fixes:
- Sidebar opacity default changed from 0→visible (fixes missing sidebar
  after page-persistence login without entrance animation)
- Console.log/error wrapped in import.meta.env.DEV guards
- Remove unused route import from RootRedirect

Beta tracking:
- CLAUDE.md: beta freeze protocol added
- MASTER_PLAN.md: TASK-11, TASK-17, phase structure
- BETA-PROGRESS.md: initial tracking doc
- Tagged v1.2.0-alpha.1 as pre-rootless baseline

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/optimize-debian.sh

@@ -53,4 +53,35 @@ EOF
 # Apply sysctl settings
 sysctl --system >/dev/null 2>&1 || true
 
+# Remove policy-rc.d if present — leftover from chroot build, blocks service starts
+rm -f /usr/sbin/policy-rc.d 2>/dev/null || true
+
+# Ensure NTP time sync via chrony (more reliable than systemd-timesyncd)
+if ! dpkg -l chrony >/dev/null 2>&1; then
+    echo "🕐 Installing chrony for NTP time sync..."
+    apt-get update -qq && apt-get install -y chrony 2>/dev/null || true
+fi
+systemctl enable chrony 2>/dev/null || true
+systemctl start chrony 2>/dev/null || true
+timedatectl set-ntp true 2>/dev/null || true
+
+# Ensure swap exists — prevents OOM kills on memory-constrained nodes
+TOTAL_MEM_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
+TOTAL_MEM_GB=$((TOTAL_MEM_KB / 1024 / 1024))
+SWAP_SIZE_GB=$((TOTAL_MEM_GB > 8 ? 8 : TOTAL_MEM_GB))
+if [ ! -f /swapfile ]; then
+    echo "💾 Creating ${SWAP_SIZE_GB}G swap file..."
+    fallocate -l ${SWAP_SIZE_GB}G /swapfile
+    chmod 600 /swapfile
+    mkswap /swapfile
+    swapon /swapfile
+    if ! grep -q '/swapfile' /etc/fstab; then
+        echo '/swapfile none swap sw 0 0' >> /etc/fstab
+    fi
+    echo "✅ Swap created: ${SWAP_SIZE_GB}G"
+else
+    echo "✅ Swap file already exists"
+    swapon /swapfile 2>/dev/null || true
+fi
+
 echo "✅ Debian optimization complete!"