feat: container orchestration, branding overhaul, onboarding logging

Container orchestration:
- Health monitor with crash recovery and auto-restart
- Doctor service (periodic health checks via systemd timer)
- Reconcile service (desired-state convergence)
- Stack-aware install/uninstall with dependency tracking

Branding:
- Custom GRUB background (designer artwork, 1024x768)
- ISOLINUX boot menu: centered, orange accents, clean labels
- Terminal banners: adaptive width, basic ANSI colors, fits 80-col
- Removed auto-generated splash scripts (designer provides assets)
- GRUB theme: lowercase branding

Frontend:
- 401 handler clears localStorage immediately (prevents cascade)

Backend:
- Onboarding/auth logging ([onboarding] tag in journalctl)
- Cookie Secure flag logging for debugging HTTP/HTTPS issues

ISO fixes:
- Install log saved before unmount (was silently failing)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/configs/archipelago-doctor.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Archipelago Container Doctor
+After=archipelago.service
+
+[Service]
+Type=oneshot
+# Runs as root: needs to kill orphaned conmon processes, fix permissions
+User=root
+ExecStart=/home/archipelago/archy/scripts/container-doctor.sh --local
+TimeoutStartSec=120
+StandardOutput=journal
+StandardError=journal

image-recipe/configs/archipelago-doctor.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Archipelago container doctor (periodic)
+
+[Timer]
+# First run 5 minutes after boot, then every 30 minutes
+OnBootSec=5min
+OnUnitActiveSec=30min
+# Jitter to avoid load spikes
+RandomizedDelaySec=60
+
+[Install]
+WantedBy=timers.target

image-recipe/configs/archipelago-reconcile.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Archipelago Container Reconciliation
+After=archipelago.service
+
+[Service]
+Type=oneshot
+User=archipelago
+Environment="XDG_RUNTIME_DIR=/run/user/1000"
+Environment="HOME=/home/archipelago"
+Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+ExecStart=/home/archipelago/archy/scripts/reconcile-containers.sh
+TimeoutStartSec=600
+StandardOutput=journal
+StandardError=journal

image-recipe/configs/archipelago-reconcile.timer

@@ -0,0 +1,14 @@
+[Unit]
+Description=Archipelago container reconciliation (periodic)
+
+[Timer]
+# First run 10 minutes after boot, then every 6 hours
+OnBootSec=10min
+OnUnitActiveSec=6h
+# Jitter to avoid load spikes
+RandomizedDelaySec=300
+# Run missed checks on boot
+Persistent=true
+
+[Install]
+WantedBy=timers.target

image-recipe/configs/archipelago.service

@@ -16,6 +16,8 @@ Restart=on-failure
 RestartSec=5
 WatchdogSec=300
 TimeoutStartSec=300
+# Bitcoin Core needs up to 600s to flush UTXO set on shutdown
+TimeoutStopSec=660
 
 # Filesystem protection
 ProtectSystem=strict