sync: update from private repo (2336949a)

SECURITY.md

@@ -21,7 +21,12 @@ MAESTRO can execute tools, browser actions, and optionally SSH commands. Treat
 it as a privileged service. For a step-by-step checklist, see
 [docs/security-hardening.md](docs/security-hardening.md).
 
-- Keep the service bound to localhost until OAuth authentication is configured.
+- A fresh install that binds a non-loopback interface (the Docker image does)
+  boots WITH a login: an admin account is generated and its password printed at
+  startup and written to `data/.initial-admin-password` (`0600`). Sign in, change
+  the password, and the reminder stops. Existing no-auth deployments are NOT
+  flipped automatically — they get a warning banner instead.
+- Keep the service bound to localhost until authentication is configured.
 - Put internet-facing deployments behind a TLS reverse proxy.
 - Set `safety.bash_sandbox: always` for multi-user deployments.
 - Keep `MCP_ENCRYPTION_KEY`, OAuth secrets, SSH keys, and provider credentials
@@ -41,6 +46,7 @@ runtime data directory and are created with restrictive permissions:
 | Session secret (signs login cookies; auto-generated when `auth.session_secret` is unset) | `data/secrets/session-secret.key` | `0600` |
 | Web Push (VAPID) keypair | `data/secrets/vapid.json` | `0600` |
 | Self-signed TLS material | `data/tls/` | `0600` keys |
+| Generated first-run admin password (removed once changed) | `data/.initial-admin-password` | `0600` |
 
 `config.yaml` may hold a provider `api_key`, so the setup tooling writes it
 `0600`. These paths are excluded from version control (`.gitignore`) and from