fix: ISO build freshness, WireGuard startup, VPN status, kiosk remote doubling

- ISO builder: run npm ci before npm run build to prevent stale UI artifacts
- Unbundled ISO: clean container-images dir to prevent bundled tars leaking
- WireGuard: use After=network.target instead of network-online.target for
  faster wg0 startup on install
- VPN status: check actual nvpn0 interface instead of config tunnel_ip to
  prevent NostrVPN from showing standalone WireGuard IP
- ContainerApps: filter out not-installed bundled apps (fixes Bitcoin Knots
  appearing on clean unbundled installs)
- Kiosk: persist kiosk mode to localStorage before /kiosk redirect so
  App.vue can skip remote relay (fixes input doubling with companion app)
- IndeedHub: fix port mapping and X-Forwarded-Prefix passthrough

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/components/PWAInstallPrompt.vue

@@ -44,7 +44,7 @@ const DISMISS_KEY = 'archipelago_pwa_install_dismissed'
 
 onMounted(() => {
   // Don't show in kiosk mode, if already dismissed, or if already installed
-  if (window.location.pathname.startsWith('/kiosk')) return
+  if (localStorage.getItem('kiosk') === 'true') return
   if (sessionStorage.getItem(DISMISS_KEY) === '1') return
   if (window.matchMedia('(display-mode: standalone)').matches) return
   if ((window.navigator as Navigator & { standalone?: boolean }).standalone) return