fix: nostr-vpn service crash on reboot, detect activating state

- Remove ReadWritePaths sandbox (causes namespace error when /run/nostr-vpn
  doesn't exist after reboot — /run is tmpfs)
- Detect both 'active' and 'activating' states in VPN status check

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/stores/server.ts

@@ -35,11 +35,17 @@ export const useServerStore = defineStore('server', () => {
           const pct = progress.size > 0 ? Math.round((progress.downloaded / progress.size) * 100) : 0
           const downloadedMB = (progress.downloaded / (1024 * 1024)).toFixed(1)
           const totalMB = (progress.size / (1024 * 1024)).toFixed(1)
+          let message = 'Downloading...'
+          if (progress.size > 1024 && pct < 100) {
+            message = `Downloading: ${downloadedMB} / ${totalMB} MB (${pct}%)`
+          } else if (pct >= 100 || (progress.size > 0 && progress.downloaded >= progress.size)) {
+            message = 'Installing package...'
+          }
           installingApps.value.set(appId, {
             ...current,
-            status: 'downloading',
+            status: pct >= 100 ? 'installing' : 'downloading',
             progress: Math.min(pct, 95),
-            message: progress.size > 0 ? `Downloading: ${downloadedMB} / ${totalMB} MB (${pct}%)` : 'Downloading...',
+            message,
           })
         }
       } else if (installingApps.value.has(appId)) {
@@ -50,6 +56,17 @@ export const useServerStore = defineStore('server', () => {
         }
       }
     }
+    // Clear installingApps entries for apps that vanished from backend data
+    // (container was removed, install failed and was cleaned up, etc.)
+    for (const [appId] of installingApps.value) {
+      if (packages && !(appId in packages)) {
+        const entry = installingApps.value.get(appId)
+        if (entry && entry.attempt > 30) {
+          // App has been "installing" for 30+ seconds but backend doesn't know about it — failed
+          installingApps.value.delete(appId)
+        }
+      }
+    }
   }, { deep: true })
 
   function setInstallProgress(appId: string, progress: Partial<InstallProgress> & { id: string; title: string }) {