Simplify port-forward UX (drop onboarding step 4) + run Njal.la DDNS on feature enable

- Onboarding: remove the redundant/error-prone 'Router Setup' step (5 steps -> 4).
  A compact 80/443 (+22 SSH) note now lives inside Domain Configuration,
  and the Element Call ports are only shown at the moment they matter:
  when enabling the feature, and afterwards on the service tile.
- Onboarding step 3: fix domain prefill bug (API returns {domains: {...}}),
  make /api/network fetch best-effort so it can never block the step.
- Enable-time port modal: streamline copy (one intro + table + pointer to
  the tile's live status view).
- Element Call tile detail: replace 5 repetitive prose blocks with 2 compact
  notes around the live-status port table.
- Njal.la DDNS: run njalla.sh immediately when a DDNS-backed feature is
  enabled (previously only ran on domain save or the 15-min cron tick).
- Harden njalla.sh handling: create the base script (shebang + IP lookup)
  if missing before appending curl lines; invoke via bash explicitly.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

app/sovran_systemsos_web/templates/onboarding.html

@@ -34,8 +34,6 @@
       <span class="onboarding-step-dot" data-step="3">3</span>
       <span class="onboarding-step-connector"></span>
       <span class="onboarding-step-dot" data-step="4">4</span>
-      <span class="onboarding-step-connector"></span>
-      <span class="onboarding-step-dot" data-step="5">5</span>
     </div>
 
     <!-- Step panels -->
@@ -144,29 +142,8 @@
         </div>
       </div>
 
-      <!-- ── Step 4: Port Forwarding ── -->
+      <!-- ── Step 4: Complete ── -->
       <div class="onboarding-panel" id="step-4" style="display:none">
-        <div class="onboarding-step-header">
-          <span class="onboarding-step-icon">🔌</span>
-          <h2 class="onboarding-step-title">Router Setup</h2>
-          <p class="onboarding-step-desc">
-            Forward these ports in your router to this Sovran_SystemsOS computer. These rules let people reach your services from outside your home network.
-            <strong>Ports 80 and 443 are required for HTTPS and SSL certificates.</strong>
-          </p>
-        </div>
-        <div class="onboarding-card" id="step-4-body">
-          <p class="onboarding-loading">Loading router setup…</p>
-        </div>
-        <div class="onboarding-footer">
-          <button class="btn btn-close-modal onboarding-btn-back" data-prev="3">← Back</button>
-          <button class="btn btn-primary onboarding-btn-next" id="step-4-next">
-            Continue →
-          </button>
-        </div>
-      </div>
-
-      <!-- ── Step 5: Complete ── -->
-      <div class="onboarding-panel" id="step-5" style="display:none">
         <div class="onboarding-hero">
           <div class="onboarding-logo">✅</div>
           <h1 class="onboarding-title">Your Sovran_SystemsOS is Ready!</h1>
@@ -180,12 +157,11 @@
           <ul class="onboarding-checklist" id="onboarding-checklist">
             <li>✅ Timezone &amp; locale configured</li>
             <li>✅ Domain configuration saved</li>
-            <li>✅ Port forwarding reviewed</li>
           </ul>
         </div>
         <div class="onboarding-footer">
-          <button class="btn btn-close-modal onboarding-btn-back" data-prev="4">← Back</button>
-          <button class="btn btn-primary" id="step-5-finish">
+          <button class="btn btn-close-modal onboarding-btn-back" data-prev="3">← Back</button>
+          <button class="btn btn-primary" id="step-4-finish">
             Go to Dashboard →
           </button>
         </div>