fix: UEFI ESP partition type, WebSocket cookie, password UX

UEFI boot:
- xorriso now uses -append_partition with ESP type GUID
  (C12A7328-F81F-11D2-BA4B-00A0C93EC93B) instead of -isohybrid-gpt-basdat
  which only creates "basic data" partitions. Strict UEFI firmware
  requires the correct ESP type to find BOOTX64.EFI.
- Uses Arch Linux ISO approach: -append_partition + appended_part_as_gpt

WebSocket/login from LAN browser:
- HTTPS nginx /ws block was missing proxy_set_header Cookie $http_cookie
  Session cookie wasn't forwarded → backend returned 401 → WS failed

Password UX:
- Renamed "Change Password" → "Set Password" with description explaining
  default password is password123

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

image-recipe/build-auto-installer-iso.sh

@@ -2786,6 +2786,10 @@ if [ ! -f "$EFI_IMG" ]; then
         -partition_offset 16 \
         "$INSTALLER_ISO"
 else
+    # UEFI fix: append efi.img as a real EFI System Partition (ESP) in GPT
+    # instead of embedding it as "basic data". Strict UEFI firmware requires
+    # the correct ESP type GUID (C12A7328-F81F-11D2-BA4B-00A0C93EC93B).
+    # This is the same approach used by Arch Linux ISOs.
     xorriso -as mkisofs -o "$OUTPUT_ISO" \
         -volid "ARCHIPELAGO" \
         -iso-level 3 \
@@ -2795,9 +2799,10 @@ else
         -b isolinux/isolinux.bin \
         -no-emul-boot -boot-load-size 4 -boot-info-table \
         -eltorito-alt-boot \
-        -e boot/grub/efi.img \
+        -e --interval:appended_partition_2:all:: \
         -no-emul-boot \
-        -isohybrid-gpt-basdat \
+        -appended_part_as_gpt \
+        -append_partition 2 C12A7328-F81F-11D2-BA4B-00A0C93EC93B "$WORK_DIR/efi.img" \
         -partition_offset 16 \
         "$INSTALLER_ISO"
 fi

image-recipe/configs/nginx-archipelago.conf

@@ -1076,6 +1076,8 @@ server {
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
         proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Cookie $http_cookie;
         proxy_read_timeout 86400s;
     }
 }