SSH enabled by default — should require explicit opt-in via TUI wizard

[eshork]

Symptom

SSH is enabled and listening immediately on boot with password authentication. Any device on the network can attempt to connect.

Root Cause

01-setup-system.chroot explicitly enables SSH (systemctl enable ssh) and sets a default password for neuraldrive-admin. This was done for development/debugging convenience but is not appropriate for production.

Expected Behavior

SSH should be disabled by default. The first-boot TUI wizard should offer to enable SSH and set credentials as part of the setup flow. Until the user explicitly opts in, the system should not be remotely accessible.

Suggested Fix

1. Change systemctl enable ssh back to systemctl disable ssh in 01-setup-system.chroot
2. Add SSH enablement to the TUI first-boot wizard (e.g., a step that asks "Enable SSH?" and sets password/keys)
3. Consider requiring key-based auth by default when SSH is enabled, with password auth as an explicit opt-in

[eshork]

Design Decision (from planning session)

SSH enablement will be folded into the existing credentials wizard step (not its own step), but users need a way to come back to this setting later to change it.

Additional requirements:

• Support baking SSH keys into the image build process
• Support dropping SSH keys onto the persistent USB storage
• Deferred to a separate PR — SSH must stay enabled during TUI development for testing/validation via SSH

Implementation note: keep SSH enabled in 01-setup-system.chroot for now. This issue will be addressed after the TUI fixes PR is validated.