fix(fips): fall back to upstream daemon npub on legacy/dev nodes

Nodes without a seed-derived FIPS key (legacy deploys, fresh pre-onboarding
installs) were reporting "Awaiting seed" in the dashboard even when the
upstream fips.service was running — status.npub was None unless
/data/identity/fips_key.pub existed.

- fips/service.rs: new read_upstream_npub() reads /etc/fips/fips.pub
  (bech32 text or raw 32 bytes) from the debian package.
- fips/mod.rs: FipsStatus::current() prefers the seed-derived npub,
  falls back to the upstream key. service_active is now TRUE if either
  archipelago-fips.service OR upstream fips.service is active; adds
  upstream_service_state to the status payload.
- fips/update.rs: resolve the upstream default branch from the GitHub
  repo API (jmcorgan/fips is on `master`, not `main`) instead of
  hardcoding — future repo rename just works.
- network/router.rs + api/rpc/router.rs: diagnostics gain wifi_ssid from
  `nmcli -t device` so the Network card can show the connected SSID.
- UI: Home.vue adds a FIPS row to the Local Network card; Server.vue
  mounts the new FipsNetworkCard and shows SSID + FIPS Mesh rows;
  HomeNetworkCard.vue removed (superseded by the inline rows).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

neode-ui/src/views/Home.vue

@@ -151,6 +151,10 @@
                   <div class="flex items-center gap-3"><div class="w-2 h-2 rounded-full" :class="systemStats.bitcoinAvailable ? 'bg-orange-400' : 'bg-white/40'"></div><span class="text-sm text-white/80">Bitcoin</span></div>
                   <span class="text-sm font-medium" :class="systemStats.bitcoinAvailable ? 'text-orange-400' : 'text-white/40'">{{ bitcoinSyncDisplay }}</span>
                 </div>
+                <div class="flex items-center justify-between p-3 bg-white/5 rounded-lg">
+                  <div class="flex items-center gap-3"><div class="w-2 h-2 rounded-full" :class="fipsDotClass"></div><span class="text-sm text-white/80">FIPS</span></div>
+                  <span class="text-sm font-medium" :class="fipsTextClass">{{ fipsStatusLabel }}</span>
+                </div>
               </div>
               <div class="home-card-buttons flex gap-2 mt-auto pt-4 shrink-0">
                 <RouterLink to="/dashboard/server" class="home-card-btn flex-1 px-4 py-2 glass-button rounded-lg text-sm font-medium text-center transition-colors">{{ t('home.manageNetwork') }}</RouterLink>
@@ -313,6 +317,27 @@ const torConnected = computed(() => {
 })
 const vpnStatus = ref({ connected: false, provider: '' })
 const vpnConnected = computed(() => vpnStatus.value.connected || (!!packages.value['tailscale'] && packages.value['tailscale'].state === PackageState.Running))
+const fipsStatus = ref<{ installed: boolean; service_active: boolean; key_present: boolean } | null>(null)
+const fipsDotClass = computed(() => {
+  const s = fipsStatus.value
+  if (!s || !s.installed) return 'bg-white/40'
+  if (s.service_active) return 'bg-green-400'
+  return 'bg-white/40'
+})
+const fipsTextClass = computed(() => {
+  const s = fipsStatus.value
+  if (!s || !s.installed) return 'text-white/40'
+  if (s.service_active) return 'text-green-400'
+  return 'text-white/40'
+})
+const fipsStatusLabel = computed(() => {
+  const s = fipsStatus.value
+  if (!s) return '…'
+  if (!s.installed) return 'Not installed'
+  if (s.service_active) return 'Active'
+  if (!s.key_present) return 'Awaiting seed'
+  return 'Inactive'
+})
 const bitcoinSyncDisplay = computed(() => {
   if (!systemStats.bitcoinAvailable) return 'Not running'
   if (systemStats.bitcoinSyncPercent >= 99.9) return 'Synced'
@@ -349,6 +374,7 @@ onMounted(async () => {
   try { const usage = await fileBrowserClient.getUsage(); cloudStorageUsed.value = usage.totalSize; cloudFolderCount.value = usage.folderCount } catch { /* not running */ }
   loadSystemStats(); systemStatsInterval = setInterval(loadSystemStats, 30000); checkUpdateStatus(); loadWeb5Status()
   rpcClient.vpnStatus().then(s => { vpnStatus.value = { connected: s.connected, provider: s.provider ?? '' } }).catch(() => {})
+  rpcClient.call<{ installed: boolean; service_active: boolean; key_present: boolean }>({ method: 'fips.status' }).then(s => { fipsStatus.value = s }).catch(() => {})
 })
 
 // Wallet modals