Dingtian harden(): rotate the admin/admin web login (cosmetic)

harden() now rotates the device's default admin/admin web-UI login via
GET /userset.cgi?<old>&<old>&<new>&<new>& (best-effort: a failure logs
and doesn't fail the assign). The new password is stored back in config
(webUser/webPassword) so a re-run can rotate again, and is stripped from
the assign response like the push secret.

Documented the load-bearing caveat: this device's CGI API is fully
UNAUTHENTICATED — config read/write, relay fire, and userset.cgi itself
all return 200 with no credentials (verified on hardware). admin/admin
gates only the browser UI, and there's no inbound-auth setting (only
session_en, which bricks the read API). So the rotation is defence-in-
depth for the UI, NOT a boundary; the signed event log remains the real
anti-fraud guarantee. Verified rotation end-to-end on 10.0.10.5
(success &0&, wrong-old-pw &2&); device left at admin/admin.

apps/server/src/routes/setup.ts

@@ -215,8 +215,8 @@ export async function setupRoutes(app: FastifyInstance, db: Db): Promise<void> {
         enabled: true,
       };
       await db.insert(laneDevices).values(row);
-      // Don't echo the push secret back.
-      const { pushPassword: _omit, ...safeConfig } = fullConfig;
+      // Don't echo device secrets back (push Digest password, web-UI login).
+      const { pushPassword: _pw, webPassword: _wp, ...safeConfig } = fullConfig;
       return reply.code(201).send({ ...row, config: safeConfig });
     },
   );