fix: 60s timeout on image pull, gitea port 3001, wireguard first-boot

Image pulls now timeout after 60s and fall through to dynamic registry
fallback instead of hanging forever when primary is unreachable.
Gitea external port corrected to 3001. WireGuard key generation
added to first-boot for fresh installs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -43,7 +43,7 @@ export const APP_PORTS: Record<string, number> = {
   'routstr':       8200,
   'indeedhub':     7778,
   'botfights':     9100,
-  'gitea':         3000,
+  'gitea':         3001,
   'dwn':           3100,
   'endurain':      8080,
 }