9d437ea476
Critical fixes: - Remove ensure_default_user() — no more auto-creating user with password123. Login page now shows "Create Password" form on first boot. User sets their own password during onboarding flow. - CSRF 403: increased retry delay from 300ms to 500ms for stale cookie recovery after remember-me session restore. - Reboot: multiple fallback methods (/sbin/reboot, sysrq, kill init) when USB is pulled and /usr/sbin isn't available. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>