fix: 60s timeout on image pull, gitea port 3001, wireguard first-boot

Image pulls now timeout after 60s and fall through to dynamic registry
fallback instead of hanging forever when primary is unreachable.
Gitea external port corrected to 3001. WireGuard key generation
added to first-boot for fresh installs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/package/install.rs

@@ -611,10 +611,19 @@ impl RpcHandler {
             }
         }
 
-        let status = child
-            .wait()
-            .await
-            .context("Failed to wait for image pull")?;
+        // Timeout primary pull after 60s — if registry is down, fail fast to fallback
+        let status = tokio::time::timeout(
+            std::time::Duration::from_secs(60),
+            child.wait(),
+        )
+        .await
+        .unwrap_or_else(|_| {
+            // Timeout: kill the stuck process
+            let _ = child.kill();
+            tracing::warn!("Image pull timed out after 60s: {}", docker_image);
+            Ok(std::process::ExitStatus::default())
+        })
+        .context("Failed to wait for image pull")?;
         if !status.success() {
             // Try all configured fallback registries dynamically
             match crate::container::registry::pull_from_registries(

neode-ui/src/views/appSession/appSessionConfig.ts

@@ -43,7 +43,7 @@ export const APP_PORTS: Record<string, number> = {
   'routstr':       8200,
   'indeedhub':     7778,
   'botfights':     9100,
-  'gitea':         3000,
+  'gitea':         3001,
   'dwn':           3100,
   'endurain':      8080,
 }