feat(onboarding): force reboot after internal boot setup and lock down wizard (#1966)

## Summary

When internal boot configuration is applied during onboarding, the
system must reboot (or shut down) to finalize setup — regardless of
whether the apply succeeded or failed. Previously, users could escape
the reboot path via the X button, back navigation, browser back, a
keyboard shortcut (`Ctrl+Alt+Shift+O`), or a URL bypass
(`?onboarding=bypass`). This left the system in a potentially broken
state if internal boot was partially configured but the user never
rebooted.

## Changes

### Lockdown mechanism
- Added `internalBootApplyAttempted` flag to the onboarding draft store
(persisted to localStorage)
- Flag is set `true` when the Summary step begins applying internal
boot, **before** the API call — this engages the lockdown immediately
- All escape hatches are gated on this flag via a single
`isInternalBootLocked` computed

### Wizard lockdown (OnboardingModal.vue)
- X close button hidden when locked
- Back button hidden on all steps when locked
- `handleExitIntent`, `goToPreviousStep` — early return when locked
- `goToStep` — blocks backward stepper clicks when locked
- `handlePopstate` — calls `window.history.forward()` to neutralize
browser back, with an `isProgrammaticHistoryExit` guard so the modal's
own `closeModal()` history navigation isn't blocked
- Removed keyboard shortcut `Ctrl+Alt+Shift+O` and URL parameter
`?onboarding=bypass` entirely (feature hasn't shipped)

### Forced reboot/shutdown on success or failure
(OnboardingNextStepsStep.vue)
- `showRebootButton` now checks `internalBootSelection !== null` instead
of `internalBootApplySucceeded` — reboot shows regardless of outcome
- Added **shutdown button** alongside reboot as a secondary option
(smaller, text-style) — mirrors the "Skip Setup" / "Get Started" CTA
pattern
- Shutdown calls the same server shutdown mutation and shows the same
confirmation dialog pattern as reboot
- Added failure alert: *"Internal boot timed out but is likely setup on
your server. Please reboot your system to finalize setup."*
- Added BIOS warning when `updateBios` was selected but apply failed —
instructs user to manually update BIOS boot order
- Made `completeOnboarding()` failure non-blocking for the
reboot/shutdown path — wraps in try/catch so users are never stuck

### Standalone lockdown (OnboardingInternalBoot.standalone.vue)
- Same lockdown: X hidden, popstate blocked, dialog dismiss blocked
- "Edit Again" disabled when locked
- "Close" button becomes **two buttons**: "Shutdown" (secondary) and
"Reboot" (primary) when locked
- BIOS warning shown on failure with `updateBios` selected
- Failure message uses same wording as wizard flow

### Log message preservation (SummaryStep + composable)
- `returnedError` and `failed` callbacks in `applyInternalBootSelection`
preserve the original error output in the user-visible log stream
- The generic "timed out / likely setup" message only appears on the
Next Steps popup — the actual error details remain in the technical logs

### i18n
- 7 new keys in `en.json` for failure messaging, BIOS warnings, shutdown
button, and dialog descriptions

## Test plan

- [x] All tests pass (64 test files, 628+ tests)
- [x] Lint passes (ESLint + Prettier)
- [x] Type-check passes (vue-tsc)
- [ ] Manual: start onboarding with internal boot eligible → select
storage boot → apply → verify lockdown engages
- [ ] Manual: simulate API failure → verify reboot AND shutdown buttons
still show + failure messaging
- [ ] Manual: verify browser back, keyboard shortcut, URL bypass all do
nothing during lockdown
- [ ] Manual: click Shutdown → confirm it calls shutdown mutation, not
reboot
- [ ] Manual: test standalone internal boot wizard with same scenarios
- [ ] Manual: verify log console still shows specific error details on
failure

## Files changed (13)

| File | Change |
|------|--------|
| `store/onboardingDraft.ts` | Added `internalBootApplyAttempted` flag +
setter + persistence |
| `store/onboardingModalVisibility.ts` | Removed bypass shortcut, URL
action, and `bypassOnboarding()` |
| `OnboardingModal.vue` | Added lockdown gates on X, back, popstate
(with programmatic exit guard), stepper, exit intent |
| `composables/internalBoot.ts` | Restored original error output in
`returnedError`/`failed` callbacks |
| `steps/OnboardingSummaryStep.vue` | Set `internalBootApplyAttempted`
before apply |
| `steps/OnboardingNextStepsStep.vue` | Forced reboot on failure,
shutdown button, failure alerts, BIOS warning, resilient
`finishOnboarding` |
| `standalone/OnboardingInternalBoot.standalone.vue` | Same lockdown +
shutdown/reboot buttons + failure messaging |
| `locales/en.json` | 7 new i18n keys |
| 5 test files | Updated/added tests for lockdown, shutdown, and failure
behavior |

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Shutdown alongside Reboot for internal-boot recovery and a
confirmation dialog for power actions.
* Modal/result UI now shows Reboot/Shutdown actions when internal-boot
is locked.

* **Improvements**
* Locked failure state removes “Edit Again” and blocks
close/back/browser-back while internal boot is in progress.
* Internal-boot timeout and BIOS-missed messaging updated with new
localization keys.
  * Onboarding flow tracks an “apply attempted” flag to drive UI state.

* **Removed**
  * Keyboard shortcut bypass for onboarding.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: Ajit-Mehrotra

web/__test__/components/Onboarding/OnboardingInternalBootStandalone.test.ts

@@ -1,3 +1,4 @@
+import { reactive } from 'vue';
 import { enableAutoUnmount, flushPromises, mount } from '@vue/test-utils';
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
@@ -21,28 +22,48 @@ type InternalBootHistoryState = {
 
 const {
   draftStore,
+  reactiveStoreRef,
   applyInternalBootSelectionMock,
+  submitInternalBootRebootMock,
+  submitInternalBootShutdownMock,
   cleanupOnboardingStorageMock,
   dialogPropsRef,
   stepPropsRef,
   stepperPropsRef,
 } = vi.hoisted(() => {
+  const reactiveRef: { value: Record<string, unknown> | null } = { value: null };
   const store = {
     internalBootSelection: null as {
       poolName: string;
       slotCount: number;
       devices: string[];
       bootSizeMiB: number;
       updateBios: boolean;
+      poolMode: 'dedicated' | 'hybrid';
     } | null,
     internalBootApplySucceeded: false,
+    internalBootApplyAttempted: false,
     setInternalBootApplySucceeded: vi.fn((value: boolean) => {
-      store.internalBootApplySucceeded = value;
+      if (reactiveRef.value) {
+        reactiveRef.value.internalBootApplySucceeded = value;
+      } else {
+        store.internalBootApplySucceeded = value;
+      }
+    }),
+    setInternalBootApplyAttempted: vi.fn((value: boolean) => {
+      if (reactiveRef.value) {
+        reactiveRef.value.internalBootApplyAttempted = value;
+      } else {
+        store.internalBootApplyAttempted = value;
+      }
     }),
   };
 
   return {
     draftStore: store,
+    reactiveStoreRef: reactiveRef,
+    submitInternalBootRebootMock: vi.fn(),
+    submitInternalBootShutdownMock: vi.fn(),
     applyInternalBootSelectionMock:
       vi.fn<
         (
@@ -74,18 +95,37 @@ vi.mock('@unraid/ui', () => ({
   },
 }));
 
+const reactiveDraftStore = reactive(draftStore);
+reactiveStoreRef.value = reactiveDraftStore;
+
 vi.mock('@/components/Onboarding/store/onboardingDraft', () => ({
-  useOnboardingDraftStore: () => draftStore,
+  useOnboardingDraftStore: () => reactiveDraftStore,
 }));
 
 vi.mock('@/components/Onboarding/composables/internalBoot', () => ({
   applyInternalBootSelection: applyInternalBootSelectionMock,
+  submitInternalBootReboot: submitInternalBootRebootMock,
+  submitInternalBootShutdown: submitInternalBootShutdownMock,
 }));
 
 vi.mock('@/components/Onboarding/store/onboardingStorageCleanup', () => ({
   cleanupOnboardingStorage: cleanupOnboardingStorageMock,
 }));
 
+vi.mock('@/components/Onboarding/components/InternalBootConfirmDialog.vue', () => ({
+  default: {
+    props: ['open', 'action', 'failed', 'disabled'],
+    emits: ['confirm', 'cancel'],
+    template: `
+      <div v-if="open" data-testid="confirm-dialog-stub">
+        <span data-testid="confirm-dialog-action">{{ action }}</span>
+        <button data-testid="confirm-dialog-confirm" @click="$emit('confirm')">Confirm</button>
+        <button data-testid="confirm-dialog-cancel" @click="$emit('cancel')">Cancel</button>
+      </div>
+    `,
+  },
+}));
+
 vi.mock('@/components/Onboarding/components/OnboardingConsole.vue', () => ({
   default: {
     props: ['logs'],
@@ -182,8 +222,9 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
     vi.clearAllMocks();
     window.history.replaceState(null, '', window.location.href);
 
-    draftStore.internalBootSelection = null;
-    draftStore.internalBootApplySucceeded = false;
+    reactiveDraftStore.internalBootSelection = null;
+    reactiveDraftStore.internalBootApplySucceeded = false;
+    reactiveDraftStore.internalBootApplyAttempted = false;
     dialogPropsRef.value = null;
     stepPropsRef.value = null;
     stepperPropsRef.value = null;
@@ -239,12 +280,13 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
   });
 
   it('applies the selected internal boot configuration and records success', async () => {
-    draftStore.internalBootSelection = {
+    reactiveDraftStore.internalBootSelection = {
       poolName: 'cache',
       slotCount: 1,
       devices: ['DISK-A'],
       bootSizeMiB: 16384,
       updateBios: true,
+      poolMode: 'hybrid',
     };
     applyInternalBootSelectionMock.mockResolvedValue({
       applySucceeded: true,
@@ -270,6 +312,7 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
         bootSizeMiB: 16384,
         updateBios: true,
         slotCount: 1,
+        poolMode: 'hybrid',
       },
       {
         configured: 'Internal boot pool configured.',
@@ -289,13 +332,14 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
     });
   });
 
-  it('shows retry affordance when the apply helper returns a failure result', async () => {
-    draftStore.internalBootSelection = {
+  it('shows locked failure result with reboot button when apply fails', async () => {
+    reactiveDraftStore.internalBootSelection = {
       poolName: 'cache',
       slotCount: 1,
       devices: ['DISK-A'],
       bootSizeMiB: 16384,
       updateBios: false,
+      poolMode: 'hybrid',
     };
     applyInternalBootSelectionMock.mockResolvedValue({
       applySucceeded: false,
@@ -316,15 +360,8 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
 
     expect(wrapper.text()).toContain('Setup Failed');
     expect(wrapper.text()).toContain('Internal boot setup returned an error: mkbootpool failed');
-    expect(wrapper.find('[data-testid="internal-boot-standalone-edit-again"]').exists()).toBe(true);
-
-    await wrapper.get('[data-testid="internal-boot-standalone-edit-again"]').trigger('click');
-    await flushPromises();
-
-    expect(stepperPropsRef.value).toMatchObject({
-      activeStepIndex: 0,
-    });
-    expect(wrapper.find('[data-testid="internal-boot-step-stub"]').exists()).toBe(true);
+    expect(wrapper.find('[data-testid="internal-boot-standalone-edit-again"]').exists()).toBe(false);
+    expect(wrapper.find('[data-testid="internal-boot-standalone-reboot"]').exists()).toBe(true);
   });
 
   it('restores the configure step when browser back leaves a reversible result', async () => {
@@ -355,13 +392,15 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
     expect(wrapper.find('[data-testid="internal-boot-step-stub"]').exists()).toBe(true);
   });
 
-  it('closes when browser back leaves a fully applied result', async () => {
-    draftStore.internalBootSelection = {
+  it('blocks browser back navigation when locked after a fully applied result', async () => {
+    const forwardSpy = vi.spyOn(window.history, 'forward').mockImplementation(() => {});
+    reactiveDraftStore.internalBootSelection = {
       poolName: 'cache',
       slotCount: 1,
       devices: ['DISK-A'],
       bootSizeMiB: 16384,
       updateBios: true,
+      poolMode: 'hybrid',
     };
 
     const wrapper = mountComponent();
@@ -384,8 +423,9 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
     });
     await flushPromises();
 
-    expect(cleanupOnboardingStorageMock).toHaveBeenCalledTimes(1);
-    expect(wrapper.find('[data-testid="dialog-stub"]').exists()).toBe(false);
+    expect(forwardSpy).toHaveBeenCalled();
+    expect(cleanupOnboardingStorageMock).not.toHaveBeenCalled();
+    expect(wrapper.find('[data-testid="dialog-stub"]').exists()).toBe(true);
   });
 
   it('closes locally after showing a result', async () => {
@@ -435,12 +475,13 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
   });
 
   it('shows warning result when apply succeeds with warnings', async () => {
-    draftStore.internalBootSelection = {
+    reactiveDraftStore.internalBootSelection = {
       poolName: 'boot-pool',
       slotCount: 1,
       devices: ['sda'],
       bootSizeMiB: 512,
       updateBios: true,
+      poolMode: 'hybrid',
     };
     applyInternalBootSelectionMock.mockResolvedValue({
       applySucceeded: true,
@@ -478,4 +519,132 @@ describe('OnboardingInternalBoot.standalone.vue', () => {
 
     expect(cleanupOnboardingStorageMock).toHaveBeenCalledTimes(1);
   });
+
+  it('hides the X button when internalBootApplyAttempted is true', async () => {
+    reactiveDraftStore.internalBootSelection = {
+      poolName: 'cache',
+      slotCount: 1,
+      devices: ['DISK-A'],
+      bootSizeMiB: 16384,
+      updateBios: false,
+      poolMode: 'hybrid',
+    };
+
+    const wrapper = mountComponent();
+
+    await wrapper.get('[data-testid="internal-boot-step-complete"]').trigger('click');
+    await flushPromises();
+
+    expect(draftStore.internalBootApplyAttempted).toBe(true);
+    expect(wrapper.find('[data-testid="internal-boot-standalone-close"]').exists()).toBe(false);
+  });
+
+  it('hides "Edit Again" button when locked after apply', async () => {
+    reactiveDraftStore.internalBootSelection = {
+      poolName: 'cache',
+      slotCount: 1,
+      devices: ['DISK-A'],
+      bootSizeMiB: 16384,
+      updateBios: false,
+      poolMode: 'hybrid',
+    };
+    applyInternalBootSelectionMock.mockResolvedValue({
+      applySucceeded: false,
+      hadWarnings: true,
+      hadNonOptimisticFailures: true,
+      logs: [{ message: 'Setup failed', type: 'error' }],
+    });
+
+    const wrapper = mountComponent();
+
+    await wrapper.get('[data-testid="internal-boot-step-complete"]').trigger('click');
+    await flushPromises();
+
+    expect(draftStore.internalBootApplyAttempted).toBe(true);
+    expect(wrapper.find('[data-testid="internal-boot-standalone-edit-again"]').exists()).toBe(false);
+  });
+
+  it('shows "Reboot" button instead of "Close" when locked', async () => {
+    reactiveDraftStore.internalBootSelection = {
+      poolName: 'cache',
+      slotCount: 1,
+      devices: ['DISK-A'],
+      bootSizeMiB: 16384,
+      updateBios: true,
+      poolMode: 'hybrid',
+    };
+
+    const wrapper = mountComponent();
+
+    await wrapper.get('[data-testid="internal-boot-step-complete"]').trigger('click');
+    await flushPromises();
+
+    expect(draftStore.internalBootApplyAttempted).toBe(true);
+    expect(wrapper.find('[data-testid="internal-boot-standalone-result-close"]').exists()).toBe(false);
+    expect(wrapper.find('[data-testid="internal-boot-standalone-reboot"]').exists()).toBe(true);
+  });
+
+  it('calls submitInternalBootReboot when reboot is confirmed through dialog', async () => {
+    reactiveDraftStore.internalBootSelection = {
+      poolName: 'cache',
+      slotCount: 1,
+      devices: ['DISK-A'],
+      bootSizeMiB: 16384,
+      updateBios: true,
+      poolMode: 'hybrid',
+    };
+
+    const wrapper = mountComponent();
+
+    await wrapper.get('[data-testid="internal-boot-step-complete"]').trigger('click');
+    await flushPromises();
+
+    await wrapper.get('[data-testid="internal-boot-standalone-reboot"]').trigger('click');
+    await flushPromises();
+
+    expect(wrapper.find('[data-testid="confirm-dialog-stub"]').exists()).toBe(true);
+    expect(wrapper.get('[data-testid="confirm-dialog-action"]').text()).toBe('reboot');
+
+    await wrapper.get('[data-testid="confirm-dialog-confirm"]').trigger('click');
+    await flushPromises();
+
+    expect(submitInternalBootRebootMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('shows shutdown button when locked and calls submitInternalBootShutdown after confirmation', async () => {
+    reactiveDraftStore.internalBootSelection = {
+      poolName: 'cache',
+      slotCount: 1,
+      devices: ['DISK-A'],
+      bootSizeMiB: 16384,
+      updateBios: false,
+      poolMode: 'hybrid',
+    };
+
+    const wrapper = mountComponent();
+
+    await wrapper.get('[data-testid="internal-boot-step-complete"]').trigger('click');
+    await flushPromises();
+
+    const shutdownButton = wrapper.find('[data-testid="internal-boot-standalone-shutdown"]');
+    expect(shutdownButton.exists()).toBe(true);
+
+    await shutdownButton.trigger('click');
+    await flushPromises();
+
+    expect(wrapper.find('[data-testid="confirm-dialog-stub"]').exists()).toBe(true);
+    expect(wrapper.get('[data-testid="confirm-dialog-action"]').text()).toBe('shutdown');
+
+    await wrapper.get('[data-testid="confirm-dialog-confirm"]').trigger('click');
+    await flushPromises();
+
+    expect(submitInternalBootShutdownMock).toHaveBeenCalledTimes(1);
+    expect(submitInternalBootRebootMock).not.toHaveBeenCalled();
+  });
+
+  it('does not show shutdown button when not locked', () => {
+    const wrapper = mountComponent();
+
+    expect(wrapper.find('[data-testid="internal-boot-standalone-shutdown"]').exists()).toBe(false);
+  });
 });

web/__test__/components/Onboarding/OnboardingInternalBootStep.test.ts

@@ -15,6 +15,7 @@ type MockInternalBootSelection = {
   devices: string[];
   bootSizeMiB: number;
   updateBios: boolean;
+  poolMode: 'dedicated' | 'hybrid';
 };
 
 type InternalBootVm = {
@@ -308,8 +309,16 @@ describe('OnboardingInternalBootStep', () => {
     );
   });
 
-  it('defaults the storage pool name to cache', async () => {
+  it('defaults the storage pool name to cache in hybrid mode', async () => {
     draftStore.bootMode = 'storage';
+    draftStore.internalBootSelection = {
+      poolName: '',
+      slotCount: 1,
+      devices: [],
+      bootSizeMiB: 16384,
+      updateBios: true,
+      poolMode: 'hybrid',
+    };
     contextResult.value = buildContext({
       assignableDisks: [
         {
@@ -332,8 +341,16 @@ describe('OnboardingInternalBootStep', () => {
     );
   });
 
-  it('leaves the pool name blank when cache already exists', async () => {
+  it('leaves the pool name blank in hybrid mode when cache already exists', async () => {
     draftStore.bootMode = 'storage';
+    draftStore.internalBootSelection = {
+      poolName: '',
+      slotCount: 1,
+      devices: [],
+      bootSizeMiB: 16384,
+      updateBios: true,
+      poolMode: 'hybrid',
+    };
     contextResult.value = buildContext({
       poolNames: ['cache'],
       assignableDisks: [