fix(01-11): remove every shipped Fedimint gateway credential (FED-07)

Six code paths configured the Lightning gateway with a bcrypt hash committed
to this repository — and one deploy path with a plaintext password literal —
whenever the per-install secret was missing. Anyone holding a copy of the repo
held the admin credential for every gateway that ever took a fallback.

container::secrets now owns the credential end to end: ensure_gateway_credential
(idempotent, delegates to ensure_one's bcrypt arm) and gateway_bcrypt_hash,
which returns Err when the secret is missing/empty and when the stored value is
on the KNOWN_DEFAULT_GATEWAY_HASHES denylist — so this codebase cannot hand
back the compromised value even to a node already carrying it.

get_app_config was widened to Result so a credential-less install cannot reach
podman run at all; configure_fedimint_lnd takes the resolved hash instead of
re-reading with its own fallback. The four shell paths stop generating
credentials entirely (dropping the htpasswd host dependency) and skip container
creation with a printed reason rather than substituting anything.

Naming converges on the manifest's fedimint-gateway-hash/.pw, with legacy
fedimint-gateway-password values copied forward rather than regenerated so no
node loses a working unique credential. Plan 01-16 owns rotation of installs
already carrying the default.

Verified: cargo build clean; cargo test -p archipelago 999 passed (2
boot_reconciler timing tests failed under concurrent load, green in isolation,
untouched by this diff); bash -n clean on all five scripts; the compromised
literal now appears exactly once in the tree, as the denylist.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/container-specs.sh

@@ -101,6 +101,10 @@ reset_spec() {
   SPEC_SECURITY="no-new-privileges:true" SPEC_RESTART="unless-stopped"
   SPEC_HEALTH_CMD="" SPEC_ENV="" SPEC_CUSTOM_ARGS="" SPEC_READONLY="false"
   SPEC_TMPFS="" SPEC_TIER="3" SPEC_DATA_DIR="" SPEC_DATA_UID="100000:100000"
+  # Set by a loader (e.g. fedimint-gateway) to signal "spec is valid but this
+  # container must not be created/recreated right now" — e.g. a required
+  # per-install secret hasn't been generated yet. Empty means no skip.
+  SPEC_SKIP_REASON=""
   # SPEC_OPTIONAL defaults true: reconcile-containers.sh only REPAIRS existing
   # containers — it never creates missing ones. Baseline (filebrowser) is
   # bootstrapped by first-boot-containers.sh; all other apps come from the
@@ -323,6 +327,16 @@ load_spec_fedimint-gateway() {
   SPEC_DATA_DIR="/var/lib/archipelago/fedimint-gateway"
   SPEC_DEPENDS="bitcoin-knots fedimint"
   SPEC_OPTIONAL="true"
+  # FED-07: no shipped fallback credential. If the per-install bcrypt hash
+  # (fedimint-gateway-hash, generated by container::secrets::ensure_gateway_credential
+  # via the daemon, first-boot, or reconcile secret-generation step) doesn't
+  # exist yet, do not build an entrypoint with an empty --bcrypt-password-hash
+  # — skip creating/recreating this container and let the caller retry once
+  # the credential exists.
+  if [ -z "$FEDI_HASH" ]; then
+    SPEC_SKIP_REASON="fedimint-gateway credential not generated yet (no shipped default; will retry once a per-install credential exists)"
+    return
+  fi
   # Custom entrypoint depends on whether LND is available
   local LND_CERT=/var/lib/archipelago/lnd/tls.cert
   local LND_MAC=/var/lib/archipelago/lnd/data/chain/bitcoin/mainnet/admin.macaroon