Fix critical bugs and improve reliability, compatibility, and usability

- Fix Homebrew installation: install sudo, set sudoers permissions, and add transparent root wrapper
- Add Debian 12 fallback when Debian 13 template is unavailable
- Ensure proper OpenClaw token authentication configuration
- Dynamically resolve binary paths in systemd services
- Configure SSH root password login
- Clean stale VNC locks on startup and prevent screen-blanking
- Add --skip-daemon flag to onboarding shortcut to avoid service conflict
- Enable nesting and onboot autostart for container
- Prompt for VMID and storage pools with auto-detected defaults

CLAUDE.md

@@ -8,28 +8,27 @@ OpenClaw on Proxmox is a single-script deployment tool (`setup-openclaw-lxc.sh`)
 
 ## Architecture
 
-The entire project is one ~460-line Bash script with this flow:
+The entire project is one Bash script with this flow:
 
-1. **Pre-flight** — Verify Proxmox CLI tools (`pct`, `pvesh`, `pveam`) and root access
-2. **User prompts** — Collect container password, disk/memory/CPU/resolution settings
-3. **Auto-detection** — Find next VMID and storage backends via `pvesh` JSON + Python parsing
-4. **Template management** — Download Debian 13 template if missing
-5. **Container creation** — Privileged LXC, DHCP networking
-6. **Package installation** — Node.js 22, Homebrew (as non-root `brewuser`), OpenClaw (npm global), LXQt, TigerVNC, noVNC, Google Chrome, OpenClaw browser extension
-7. **Configuration** — OpenClaw gateway settings, VNC password/xstartup, noVNC auto-scaling patch, Chrome as default browser
-8. **Desktop integration** — Desktop shortcuts for onboarding wizard and dashboard
-9. **Systemd services** — Three auto-starting services: `openclaw-gateway` (port 18789), `vncserver` (:1/5901), `novnc` (port 6080)
-10. **Verification** — Check all services are active, print connection info
+1. **Pre-flight** — Verify Proxmox CLI tools (`pct`, `pvesh`, `pveam`), root access, and x86_64 architecture
+2. **Auto-detection & User prompts** — Detect next VMID and available storages, prompt user with smart defaults
+3. **Template management** — Check local storage, download Debian 13 or fallback to Debian 12 template
+4. **Container creation** — Privileged LXC with nesting enabled, DHCP networking, onboot autostart
+5. **Package installation** — Node.js 22, Homebrew (as non-root `brewuser`), OpenClaw (npm global), LXQt, TigerVNC, noVNC, Google Chrome, OpenClaw browser extension, OpenSSH server
+6. **Configuration** — OpenClaw gateway settings (`gateway.auth.mode token`), VNC password/xstartup (no blanking), noVNC auto-scaling patch, Chrome as default browser (`--no-sandbox` wrapper), SSH root login
+7. **Desktop integration** — Desktop shortcuts for onboarding wizard (`--skip-daemon`) and dashboard (pre-filled token)
+8. **Systemd services** — Three auto-starting services with dynamically detected binaries: `openclaw-gateway` (port 18789), `vncserver` (:1/5901), `novnc` (port 6080)
+9. **Verification** — Check all services are active, print connection info (direct one-click URLs)
 
 Key helper: `ct_exec()` wraps `pct exec $VMID -- bash -c` for all in-container commands.
 
 ## Development Notes
 
 - No build system, test suite, or linter — this is a standalone Bash script
-- Uses `set -euo pipefail` for strict error handling
+- Uses `set -euo pipefail` and ERR trap for strict error handling and cleanup tips
 - All in-container operations use heredoc-embedded config files (systemd units, desktop files, wrapper scripts)
 - Colorized output via `info()`, `ok()`, `warn()`, `err()`, `fatal()` helper functions
-- Homebrew is installed under a dedicated `brewuser` account (non-root requirement) with a symlink at `/usr/local/bin/brew` for root access
+- Homebrew is installed under a dedicated `brewuser` account (non-root requirement) with passwordless sudo (`0440` permission) and a transparent wrapper script at `/usr/local/bin/brew` so root and OpenClaw can run `brew` commands
 - The noVNC auto-scaling patch modifies `/usr/share/novnc/app/ui.js` in-place via `sed`
 - Auth token is generated with `openssl rand -hex 16`