fix: ISO build freshness, WireGuard startup, VPN status, kiosk remote doubling

- ISO builder: run npm ci before npm run build to prevent stale UI artifacts
- Unbundled ISO: clean container-images dir to prevent bundled tars leaking
- WireGuard: use After=network.target instead of network-online.target for
  faster wg0 startup on install
- VPN status: check actual nvpn0 interface instead of config tunnel_ip to
  prevent NostrVPN from showing standalone WireGuard IP
- ContainerApps: filter out not-installed bundled apps (fixes Bitcoin Knots
  appearing on clean unbundled installs)
- Kiosk: persist kiosk mode to localStorage before /kiosk redirect so
  App.vue can skip remote relay (fixes input doubling with companion app)
- IndeedHub: fix port mapping and X-Forwarded-Prefix passthrough

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/App.vue

@@ -104,7 +104,8 @@ watch(() => appStore.isAuthenticated, (authenticated) => {
     screensaverStore.resetInactivityTimer()
     // Don't start relay on kiosk — kiosk gets input via xdotool (system-level),
     // relay would duplicate every keystroke/click as DOM events
-    const isKiosk = window.location.pathname.startsWith('/kiosk')
+    const isKiosk = localStorage.getItem('kiosk') === 'true'
+      || new URLSearchParams(window.location.search).has('kiosk')
     if (!isKiosk) {
       startRemoteRelay()
     }

neode-ui/src/components/PWAInstallPrompt.vue

@@ -44,7 +44,7 @@ const DISMISS_KEY = 'archipelago_pwa_install_dismissed'
 
 onMounted(() => {
   // Don't show in kiosk mode, if already dismissed, or if already installed
-  if (window.location.pathname.startsWith('/kiosk')) return
+  if (localStorage.getItem('kiosk') === 'true') return
   if (sessionStorage.getItem(DISMISS_KEY) === '1') return
   if (window.matchMedia('(display-mode: standalone)').matches) return
   if ((window.navigator as Navigator & { standalone?: boolean }).standalone) return

neode-ui/src/router/index.ts

@@ -87,6 +87,11 @@ const router = createRouter({
       path: '/kiosk',
       name: 'kiosk',
       redirect: '/',
+      beforeEnter: () => {
+        // Persist kiosk mode before redirect so App.vue can skip the remote relay
+        // (relay duplicates xdotool input on the kiosk display)
+        localStorage.setItem('kiosk', 'true')
+      },
     },
     {
       path: '/dashboard',

neode-ui/src/views/ContainerApps.vue

@@ -210,7 +210,10 @@ const store = useContainerStore()
 const appLauncherStore = useAppLauncherStore()
 
 // Use enriched bundled apps with runtime data (like lan_address)
-const bundledApps = computed(() => store.enrichedBundledApps)
+// Only show apps that actually have a container (hides pre-defined apps on unbundled installs)
+const bundledApps = computed(() => store.enrichedBundledApps.filter(
+  app => store.getAppState(app.id) !== 'not-installed'
+))
 
 // Get current host for launch URLs
 const currentHost = computed(() => window.location.hostname)