fix: AIUI /aiui/ base path, nginx alias cycle, VPN auth, container boot

- AIUI: rebuild with /aiui/ base path (router, chunk loader, SW scope)
- nginx: remove alias from /aiui/ location (caused try_files redirect cycle)
- VPN: WireGuard standalone setup, auth improvements
- ISO: build script hardening, service file updates
- first-boot-containers: networking stack fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

demo/aiui/assets/classDiagram-2ON5EDUG-pG5FcKCa.js

@@ -0,0 +1 @@
+import{s as a,c as s,a as e,C as t}from"./chunk-B4BG7PRW-1SR22WeC.js";import{_ as i}from"./mermaid.core-DaNhpuX9.js";import"./chunk-FMBD7UC4-DGED6SBi.js";import"./chunk-55IACEB6-CWcaiZ1g.js";import"./chunk-QN33PNHL-C8Gh8Kbh.js";import"./index-Lh5NfTCq.js";var u={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{u as diagram};