security: remove node credentials from tracked files (open-source Phase 1)

Scrubs the fleet SSH/UI password from every tracked file (22 occurrences)
and removes inline credentials from the code paths that used them.

Docs and trackers keep the surrounding context — these are published under
docs/history/ per the open-source plan — with the literals replaced by
<FLEET_PW> / <FLEET_PW_ALT> so the "two variants exist" detail survives
without the values.

Three of the eight files were in .planning/ and were NOT in the plan's
enumerated list; the reworked audit-secrets.sh found them.

Code changes:
- neode-ui/test-openwrt.mjs: node URL and password come from ARCHY_NODE_URL /
  ARCHY_NODE_PW; the SSH target derives from the URL instead of a hardcoded
  tailnet IP; exits 2 when unset.
- scripts/run-post-install-tests.sh: drops the built-in "testpass123!"
  default and adds --password-stdin; refuses to run unauthenticated instead
  of silently trying a known password. --phase1-only still needs no password.
- .gitea/workflows/post-install-tests.yml: sshpass with an inline literal
  replaced by key auth (NODE_SSH_KEY secret); password comes from the
  NODE_UI_PASSWORD secret and is piped over stdin rather than argv, so it
  stays out of the node's process list and the job log. Default target IP
  removed.

scripts/audit-secrets.sh now reports 5/5 pass, 0 fail.

Note: rotation of the exposed credentials is deliberately deferred to the
pre-publish gate and is NOT done by this commit — these values are still
live. See Phase 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/bitcoin-version-bulletproof-rollout.md

@@ -99,7 +99,7 @@ lock, so the managed service (held stopped) can't collide. When it has connected
 to ~the prior tip (height ≥ ~955800) it's done; then:
 
 ```sh
-# on .228 (SSH/sudo/UI pw all: ThisIsWeb54321@)
+# on .228 (SSH/sudo/UI pw all: <FLEET_PW>)
 podman stop -t 600 bitcoin-knots-reindex && podman rm bitcoin-knots-reindex
 # start the managed service via RPC (sets desired=running, clears user_stopped):
 #   package.start {id: bitcoin-knots}  (POST https://127.0.0.1/rpc/v1, CSRF: echo csrf_token cookie as X-CSRF-Token)
@@ -128,4 +128,4 @@ NO `Error initializing block database` and NO data loss:
   Core 29.2** (exists). Revisit if a Knots 29.2 was meant.
 - Reindex is unavoidable ONLY because .228's index was already corrupted by the pre-fix
   crash loop; a normal switch on the fixed binary does NOT reindex.
-- Creds for .228: SSH/sudo + UI/RPC all `ThisIsWeb54321@`.
+- Creds for .228: SSH/sudo + UI/RPC all `<FLEET_PW>`.