fix: ISO build freshness, WireGuard startup, VPN status, kiosk remote doubling

- ISO builder: run npm ci before npm run build to prevent stale UI artifacts
- Unbundled ISO: clean container-images dir to prevent bundled tars leaking
- WireGuard: use After=network.target instead of network-online.target for
  faster wg0 startup on install
- VPN status: check actual nvpn0 interface instead of config tunnel_ip to
  prevent NostrVPN from showing standalone WireGuard IP
- ContainerApps: filter out not-installed bundled apps (fixes Bitcoin Knots
  appearing on clean unbundled installs)
- Kiosk: persist kiosk mode to localStorage before /kiosk redirect so
  App.vue can skip remote relay (fixes input doubling with companion app)
- IndeedHub: fix port mapping and X-Forwarded-Prefix passthrough

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/fix-indeedhub-containers.sh

@@ -173,7 +173,7 @@ echo "Creating indeedhub frontend..."
 podman run -d --name indeedhub \
   --restart unless-stopped \
   --network "$NETWORK" \
-  -p 7777:7777 \
+  -p 7778:7777 \
   --label "com.archipelago.app=indeedhub" \
   --label "com.archipelago.title=IndeedHub" \
   --label "com.archipelago.version=0.1.0" \
@@ -200,6 +200,11 @@ if podman ps --format '{{.Names}}' 2>/dev/null | grep -q "^indeedhub$"; then
     rm -f /tmp/ih-nginx.conf
   fi
 
+  # Fix X-Forwarded-Prefix for NIP-98 URL reconstruction in iframe context
+  # The outer Archipelago nginx sets X-Forwarded-Prefix to /app/indeedhub;
+  # the inner nginx must pass it through (appending /api) instead of hardcoding /api
+  podman exec indeedhub sed -i 's|proxy_set_header X-Forwarded-Prefix /api;|proxy_set_header X-Forwarded-Prefix $http_x_forwarded_prefix/api;|' /etc/nginx/conf.d/default.conf 2>/dev/null || true
+
   # Replace DNS-based upstream resolution with hardcoded container IPs
   # (podman DNS resolver 127.0.0.11 is unreliable, causing 502 errors)
   API_IP=$(podman inspect indeedhub-build_api_1 --format "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}" 2>/dev/null)