Require admin password change on first login

[matteius]

Part of #492.

Decision

LightNVR keeps admin / admin as the bootstrap credential — it is predictable, it is what the container and bare-metal paths both produce, and it does not depend on an operator finding a generated string in a log. The documentation now says so plainly instead of claiming the password is auto-generated (which it has not been since 453fbbd).

Keeping a known default is only acceptable if the product makes it hard to keep. That is what this issue is for.

Current behavior

• db_auth_init() (src/database/db_auth.c) creates admin with the [web] password from lightnvr.ini if one is set, otherwise the literal admin.
• The web server binds 0.0.0.0 by default.
• The setup wizard (web/js/components/preact/SetupWizard.jsx:65, :189) shows a password reminder — advisory text the user can click straight past.
• Nothing prevents an install from running indefinitely on admin / admin.

Proposed behavior

A new install that is still on the default password cannot use the UI for anything else until the password is changed.

• Add a must_change_password flag on the user row, set when the account is created with the fallback admin password. Do not set it when the operator supplied [web] password before first start — they already chose a credential.
• Return the flag in the login response, alongside the existing password_change_locked (src/web/api_handlers_auth_backend_agnostic.c:558 is the precedent).
• When the flag is set, the frontend routes to a blocking password-change screen. No dismiss, no navigation away.
• Clear the flag on a successful change to something that is not admin.
• The session issued before the change should be usable only for the change-password call.

Edge cases worth deciding

• Existing installs. Do not flag accounts that already exist on upgrade — an operator who deliberately kept the default should not be locked out by an update landing at 3am. A dismissible banner is the right pressure there, not a gate.
• API clients. The gate belongs in the UI flow; API-key auth should not start failing because a human has not logged in yet. Decide whether API access is permitted while the flag is set.
• Demo mode (demo_mode) intentionally runs on known credentials — it must bypass the gate.
• MFA. If force_mfa_on_login is set, decide the order. Password change first is the simpler story.

Acceptance criteria

• A fresh install cannot reach any page except the password-change screen while on the default password
• Setting [web] password before first start skips the gate entirely
• Upgrading an existing install does not lock anyone out
• Demo mode is unaffected
• The startup banner and the docs both describe whatever this lands as

Related

• The startup banner has been corrected to stop announcing Password: admin when the operator supplied their own password in the config file.
• Docs across README, DOCKER.md, CONFIGURATION.md, and TROUBLESHOOTING.md now state the real default and carry the warning.