fix: filebrowser port bind, CSRF in tests, console-setup, auto-test scope

FileBrowser crash fix:
- Add --cap-add=NET_BIND_SERVICE (port 80 needs it with --cap-drop=ALL)
- Add --cap-add=DAC_OVERRIDE for rootless volume access
- Both in first-boot script and backend config.rs

Test script fixes:
- Extract csrf_token cookie and send as X-CSRF-Token header on RPC calls
- Add --phase1-only flag for safe install-only checks (no side effects)
- Auto-test service uses --phase1-only so it doesn't steal onboarding

Install fixes:
- Pre-create ~/.local/share/containers (ReadWritePaths mount namespace error)
- Fix console-setup.service: add After=tmp.mount + ExecStartPre mkdir /tmp

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/run-post-install-tests.sh

@@ -3,15 +3,24 @@
 # Run on an installed Archipelago node (SSH or local).
 #
 # Usage: bash run-post-install-tests.sh [password]
-#   password defaults to "testpass123!" for fresh installs
+#        bash run-post-install-tests.sh --phase1-only     # Install checks only (no auth)
 #
 # Tests:
-#   Phase 1: Install verification (services, files, logs)
-#   Phase 2: Onboarding (password setup, auth flow)
-#   Phase 3: Container lifecycle (install 3 apps, start/stop/health)
+#   Phase 1: Install verification (services, files, logs) — safe, no side effects
+#   Phase 2: Onboarding (password setup, auth flow) — creates user account
+#   Phase 3: Container lifecycle (install 3 apps, start/stop/health) — needs auth
 set -u
 
-PASSWORD="${1:-testpass123!}"
+PHASE1_ONLY=false
+PASSWORD="testpass123!"
+
+for arg in "$@"; do
+  case "$arg" in
+    --phase1-only) PHASE1_ONLY=true ;;
+    *) PASSWORD="$arg" ;;
+  esac
+done
+
 BASE="http://127.0.0.1:5678"
 JAR="/tmp/e2e-cookies.txt"
 rm -f "$JAR"
@@ -22,11 +31,23 @@ fail() { FC=$((FC + 1)); printf "\033[31m  ✗ %s — %s\033[0m\n" "$1" "${2:-}"
 skip() { SC=$((SC + 1)); printf "\033[33m  ⊘ %s\033[0m\n" "$1"; }
 section() { printf "\n\033[1m━━━ %s ━━━\033[0m\n" "$1"; }
 
+# Extract CSRF token from cookie jar
+get_csrf() {
+  grep 'csrf_token' "$JAR" 2>/dev/null | awk '{print $NF}'
+}
+
 rpc() {
   local method="$1"
   local params="${2:-"{}"}"
+  local csrf
+  csrf=$(get_csrf)
+  local csrf_header=""
+  if [ -n "$csrf" ]; then
+    csrf_header="-H X-CSRF-Token:${csrf}"
+  fi
   curl -s -b "$JAR" -c "$JAR" \
     -H "Content-Type: application/json" \
+    $csrf_header \
     -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"$method\",\"params\":$params}" \
     "${BASE}/rpc/v1" 2>/dev/null
 }
@@ -153,6 +174,17 @@ else
   fail "Nginx config" "nginx -t failed"
 fi
 
+# ── Phase 1 exit point ──
+if [ "$PHASE1_ONLY" = "true" ]; then
+  section "Results (Phase 1 only)"
+  TOTAL=$((PC + FC + SC))
+  printf "\n  \033[32mPassed: %d\033[0m  \033[31mFailed: %d\033[0m  \033[33mSkipped: %d\033[0m  Total: %d\n\n" "$PC" "$FC" "$SC" "$TOTAL"
+  [ "$FC" -gt 0 ] && echo "  Phase 1: SOME CHECKS FAILED" && exit 1
+  echo "  Phase 1: ALL CHECKS PASSED"
+  echo "  Run without --phase1-only to test onboarding + containers"
+  exit 0
+fi
+
 # ═══════════════════════════════════════════
 # PHASE 2: Onboarding & Auth
 # ═══════════════════════════════════════════