fix: disable kdeconnect autostart + document taskbar limitation

Bootstrap now creates the kdeconnect.daemon.desktop override with
Hidden=true so new KDE VNC containers don't get Bluetooth/network
discovery spam from kdeconnectd in the journal.

README documents the known task manager limitation: minimized windows
disappear from taskbar because kwin_wayland does not expose
org_kde_plasma_window_management in nested mode. Alt+Tab workaround
documented.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Johan

README.md

@@ -83,6 +83,8 @@ SDDM and plasmalogin both require `/dev/tty1` which does not exist in nspawn con
 
 **Keyboard layout** is selected at bootstrap time (Swedish, English/US, Spanish, or German). The layout is applied to both labwc (outer compositor, where wayvnc receives raw VNC key input) and kwin (inner KDE session). KDE Plasma 6's default decoration shows only a close button — the bootstrap overrides this via a system-wide dconf rule so that minimize, maximize, and close all appear.
 
+**Known limitation — task manager:** The taskbar shows open windows but does not track minimized windows. This is a Wayland protocol limitation: KDE's task manager (`libtaskmanager`) requires `org_kde_plasma_window_management`, a KDE-specific protocol that kwin_wayland does not expose to clients when running as a nested compositor inside labwc. There is no fallback in KDE 6.6 — neither `zwlr_foreign_toplevel_manager_v1` nor `ext_foreign_toplevel_list_v1` is used by the task manager. In practice: **use Alt+Tab** to switch between windows and restore minimized ones. Alt+Tab is handled entirely inside kwin and works correctly.
+
 The initial lead that pointed toward the wlroots-compositor approach came from a [community gist on headless KDE Plasma under Wayland](https://gist.github.com/GithubUser5462/9cad267d7a87d1f178c89271c2c00e46), which in turn traced back to a [discussion on the KDE forums](https://discuss.kde.org/t/headless-remote-access-under-wayland/19055). The nested kwin architecture was worked out through direct experimentation in a Fedora 44 container.
 
 ## cockpit-nspawn is tested on

src/CreateMachineDialog.jsx

@@ -703,11 +703,17 @@ export function CreateMachineDialog({ images, onClose, onRefresh, onAddNotificat
                     );
                     // kwinrc: set SSD button layout (I=minimize, A=maximize, X=close on right)
                     // This affects kwin's own decorations and is read by xdg-desktop-portal-kde.
+                    // Desktops.Number=1: enforce a single virtual desktop so the task manager
+                    // never loses minimized windows to a different virtual desktop.
                     const kwinrcContent = [
                         '[org.kde.kdecoration2]',
                         'ButtonsOnLeft=',
                         'ButtonsOnRight=IAX',
                         '',
+                        '[Desktops]',
+                        'Number=1',
+                        'Rows=1',
+                        '',
                     ].join('\n');
                     await cockpit.file(
                         `/var/lib/machines/${name}/home/kdeuser/.config/kwinrc`,
@@ -900,6 +906,32 @@ export function CreateMachineDialog({ images, onClose, onRefresh, onAddNotificat
                         append(`Varning: dconf update misslyckades (${dconfErr.message}).\n`);
                     }
 
+                    // Disable kdeconnect autostart: kdeconnectd tries to use Bluetooth and
+                    // broadcasts network discovery, which generates harmless but noisy errors
+                    // in the journal inside a container (no Bluetooth hardware available).
+                    await cockpit.spawn(
+                        ['mkdir', '-p', `/var/lib/machines/${name}/home/kdeuser/.config/autostart`],
+                        { superuser: 'require', err: 'out' }
+                    );
+                    await cockpit.file(
+                        `/var/lib/machines/${name}/home/kdeuser/.config/autostart/org.kde.kdeconnect.daemon.desktop`,
+                        { superuser: 'require' }
+                    ).replace('[Desktop Entry]\nHidden=true\n');
+
+                    // Mask fwupd: firmware update daemon cannot function in a container
+                    // (no hardware devices, no kernel firmware interfaces). Without masking,
+                    // fwupd.service fails to start and KDE Discover shows "unit failed" in
+                    // its Updates section when it tries to poll the fwupd D-Bus backend.
+                    try {
+                        await cockpit.spawn(
+                            ['systemd-run', `--machine=${name}`, '--wait', '--pipe', '--',
+                             'systemctl', 'mask', 'fwupd', 'fwupd-refresh.timer'],
+                            { superuser: 'require', err: 'out' }
+                        ).stream(append);
+                    } catch (fwupdErr) {
+                        append(`Notera: fwupd-mask misslyckades (${fwupdErr.message}).\n`);
+                    }
+
                     append(`\nKDE Plasma VNC-server kör på port 5900.\n`);
                     append(`Anslut med VNC-klient (t.ex. Remmina) till port 5900 — inget lösenord.\n`);
                 } else {