fix(boot): TUI mode now properly overrides kiosk

- cmdline-handler: Use systemctl mask to prevent kiosk startup
- cmdline-handler: Kill X11/Chromium if already running
- cmdline-handler: Create generator drop-in for correct target
- kiosk.service: Wait for cmdline handler before starting
- tui.service: Wait for cmdline handler before starting

Fixes: TUI boot menu option was loading Kiosk GUI instead

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

image/sbin/secubox-cmdline-handler

@@ -68,15 +68,29 @@ apply_settings() {
             rm -f "${MARKER_DIR}/.kiosk-enabled"
             touch "${MARKER_DIR}/.tui-enabled"
 
-            # Disable kiosk, enable TUI
-            systemctl disable secubox-kiosk.service 2>/dev/null || true
+            # Mask kiosk service to prevent any startup
+            systemctl mask secubox-kiosk.service 2>/dev/null || true
             systemctl stop secubox-kiosk.service 2>/dev/null || true
+
+            # Kill any X11/Chromium if already started
+            pkill -9 Xorg 2>/dev/null || true
+            pkill -9 chromium 2>/dev/null || true
+
+            # Enable TUI service
+            systemctl unmask secubox-console-tui.service 2>/dev/null || true
             systemctl enable secubox-console-tui.service 2>/dev/null || true
 
-            # Set multi-user target (no graphical)
+            # Set multi-user target for current AND future boots
             systemctl set-default multi-user.target 2>/dev/null || true
 
-            # Start TUI service (will run on tty1)
+            # Write to generator drop-in to ensure correct target on this boot
+            mkdir -p /run/systemd/generator
+            echo "[Unit]" > /run/systemd/generator/default.target
+            echo "Requires=multi-user.target" >> /run/systemd/generator/default.target
+
+            systemctl daemon-reload 2>/dev/null || true
+
+            # Start TUI service
             log "Starting console TUI service..."
             systemctl start secubox-console-tui.service 2>/dev/null &
             ;;

image/systemd/secubox-console-tui.service

@@ -1,6 +1,11 @@
 [Unit]
 Description=SecuBox Console TUI Dashboard
 Documentation=https://secubox.in/docs/tui
+
+# Wait for cmdline handler to decide display mode FIRST
+After=secubox-cmdline.service
+Requires=secubox-cmdline.service
+
 After=multi-user.target
 After=network-online.target
 After=secubox-firstboot.service

image/systemd/secubox-kiosk.service

@@ -2,6 +2,10 @@
 Description=SecuBox Kiosk Mode (X11/Chromium)
 Documentation=https://secubox.in/docs/kiosk
 
+# Wait for cmdline handler to decide display mode FIRST
+After=secubox-cmdline.service
+Requires=secubox-cmdline.service
+
 # Proper dependency chain - wait for everything to be ready
 After=systemd-user-sessions.service
 After=plymouth-quit-wait.service