fix: AIUI /aiui/ base path, nginx alias cycle, VPN auth, container boot

- AIUI: rebuild with /aiui/ base path (router, chunk loader, SW scope)
- nginx: remove alias from /aiui/ location (caused try_files redirect cycle)
- VPN: WireGuard standalone setup, auth improvements
- ISO: build script hardening, service file updates
- first-boot-containers: networking stack fixes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

image-recipe/archipelago-scripts/install-to-disk.sh

@@ -108,11 +108,11 @@ echo "📋 Installing base system..."
 
 # Install base system using debootstrap
 if command -v debootstrap >/dev/null 2>&1; then
-    debootstrap --arch=amd64 bookworm /mnt/archipelago http://deb.debian.org/debian
+    debootstrap --arch=amd64 trixie /mnt/archipelago http://deb.debian.org/debian
 else
     echo "❌ debootstrap not found. Installing..."
     apt-get update && apt-get install -y debootstrap
-    debootstrap --arch=amd64 bookworm /mnt/archipelago http://deb.debian.org/debian
+    debootstrap --arch=amd64 trixie /mnt/archipelago http://deb.debian.org/debian
 fi
 
 echo "⚙️  Configuring system..."
@@ -149,9 +149,9 @@ echo "📦 Configuring package sources..."
 
 # Create sources.list
 cat > /mnt/archipelago/etc/apt/sources.list <<EOF
-deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
-deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
-deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian trixie main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
+deb http://security.debian.org/debian-security trixie-security main contrib non-free non-free-firmware
 EOF
 
 echo "📥 Updating package lists..."