Ease-of-use fixes and headless satellite

• Improved first-run setup: added blocking model-download preflight, clearer HTTPS URL/banner guidance, and moved Home Assistant/SearXNG setup into an optional Connect step.
• Deployment hardening: added single-port HTTP/HTTPS TLS sniffing, /ready health endpoint and Docker HEALTHCHECK, plus first-boot data ownership handling.
• Expanded and stabilized clients: introduced a configurable headless satellite client; fixed browser/iOS microphone, loudspeaker, TTS muting, endpoint duplication, and barge-in-related behavior.