fix: AIUI /aiui/ base path, nginx alias cycle, VPN auth, container boot

- AIUI: rebuild with /aiui/ base path (router, chunk loader, SW scope)
- nginx: remove alias from /aiui/ location (caused try_files redirect cycle)
- VPN: WireGuard standalone setup, auth improvements
- ISO: build script hardening, service file updates
- first-boot-containers: networking stack fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

demo/aiui/assets/stateDiagram-v2-4FDKWEC3-DCr2kVu5.js

@@ -0,0 +1 @@
+import{s as e,b as r,a,S as s}from"./chunk-DI55MBZ5-CqWBFVaC.js";import{_ as i}from"./mermaid.core-DaNhpuX9.js";import"./chunk-55IACEB6-CWcaiZ1g.js";import"./chunk-QN33PNHL-C8Gh8Kbh.js";import"./index-Lh5NfTCq.js";var p={parser:a,get db(){return new s(2)},renderer:r,styles:e,init:i(t=>{t.state||(t.state={}),t.state.arrowMarkerAbsolute=t.arrowMarkerAbsolute},"init")};export{p as diagram};