security: remove node credentials from tracked files (open-source Phase 1)

Scrubs the fleet SSH/UI password from every tracked file (22 occurrences)
and removes inline credentials from the code paths that used them.

Docs and trackers keep the surrounding context — these are published under
docs/history/ per the open-source plan — with the literals replaced by
<FLEET_PW> / <FLEET_PW_ALT> so the "two variants exist" detail survives
without the values.

Three of the eight files were in .planning/ and were NOT in the plan's
enumerated list; the reworked audit-secrets.sh found them.

Code changes:
- neode-ui/test-openwrt.mjs: node URL and password come from ARCHY_NODE_URL /
  ARCHY_NODE_PW; the SSH target derives from the URL instead of a hardcoded
  tailnet IP; exits 2 when unset.
- scripts/run-post-install-tests.sh: drops the built-in "testpass123!"
  default and adds --password-stdin; refuses to run unauthenticated instead
  of silently trying a known password. --phase1-only still needs no password.
- .gitea/workflows/post-install-tests.yml: sshpass with an inline literal
  replaced by key auth (NODE_SSH_KEY secret); password comes from the
  NODE_UI_PASSWORD secret and is piped over stdin rather than argv, so it
  stays out of the node's process list and the job log. Default target IP
  removed.

scripts/audit-secrets.sh now reports 5/5 pass, 0 fail.

Note: rotation of the exposed credentials is deliberately deferred to the
pre-publish gate and is NOT done by this commit — these values are still
live. See Phase 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/archive/HANDOVER-2026-07-02-iso-feedback.md

@@ -17,7 +17,7 @@ only those three.
 
 ## ⚠️ Outstanding user request for the deploy
 
-- **Change .81's web-UI password to `ThisIsWeb54321@`** — the user forgot the
+- **Change .81's web-UI password to `<FLEET_PW>`** — the user forgot the
   current one. Node was unreachable from .116 during this session (flaky WiFi
   AP, IP flapped .68↔.81). Do this during deploy (SSH works from the user's
   machine; `archipelago`/`archipelago`).

docs/archive/SESSION-1.8.0-OTA-PROGRESS.md

@@ -26,7 +26,7 @@ Updated: 2026-06-30
   (`contact_id:1128152268`) now returns **`"encrypted":true`** — confirms the
   `archy || peer_pkc_capable(contact_id)` TX fix is live, not just compiled.
 - `.228`'s RPC password in memory (`password123`) was stale — user confirmed the correct
-  password is `ThisIsWeb54321@` (same as `.198`/`.116`, i.e. fully unified now). Re-verified via
+  password is `<FLEET_PW>` (same as `.198`/`.116`, i.e. fully unified now). Re-verified via
   RPC: `mesh.peers` shows 3ccc `pkc_capable:true`, and `mesh.send` to 3ccc returns
   `"encrypted":true` — #17 confirmed live on `.228` too, not just `.198`.
 
@@ -94,7 +94,7 @@ has been asked for/owned by this session.
 **`Mesh-CAkPgvLo.js`**, `archipelago` active on each:
 `.116`, `.198`, `.228` (LAN, archipelago@ + `~/.ssh/archipelago-deploy`),
 `100.72.136.5`, `100.89.209.89` (Tailscale, same key — installed this session;
-SSH user `archipelago` / pw `ThisIsWeb54321@`; NOPASSWD sudo on all 5).
+SSH user `archipelago` / pw `<FLEET_PW>`; NOPASSWD sudo on all 5).
 
 **Shipped this session (commit `12e7990b` on `main`, pushed to gitea-vps2):**
 - ✅ **#16 public-channel routing** — inbound Meshtastic text to `BROADCAST_NUM`
@@ -243,7 +243,7 @@ on-device (the caveat above).
 
 ### TEST RECIPE (works on each node)
 - RPC helper used this session: a node-side `rpc.sh` that logs in (password
-  `ThisIsWeb54321@`), grabs the `csrf_token` cookie, echoes it as `X-CSRF-Token`, and POSTs to
+  `<FLEET_PW>`), grabs the `csrf_token` cookie, echoes it as `X-CSRF-Token`, and POSTs to
   `http://127.0.0.1:5678/rpc/v1`. Recreate it or run archy's RPC directly. Methods:
   `mesh.peers`, `mesh.status`, `mesh.messages`, `mesh.send {contact_id,message}`,
   `mesh.broadcast`, `mesh.reboot-radio {seconds}`.
@@ -260,7 +260,7 @@ on-device (the caveat above).
   build --release -p archipelago --bin archipelago`. (If `rust-lld: undefined hidden symbol`,
   it's incremental cache — `CARGO_INCREMENTAL=0` fixes it.)
 - SSH key `~/.ssh/archipelago-deploy` is authorized on `.116/.198/.228`. SSH/UI/RPC password
-  `ThisIsWeb54321@`. Per node: scp the binary, `sudo systemctl stop archipelago` →
+  `<FLEET_PW>`. Per node: scp the binary, `sudo systemctl stop archipelago` →
   `kill -9 $(pgrep -x archipelago)` → `install -m0755` to `/usr/local/bin/archipelago` →
   `systemctl start archipelago`. Verify by `sha256sum` match + `systemctl is-active`.
 - **Current deployed sha on all 3 = `ba4aed590027690d`** (the reboot-enabled build).