fix(01-11): remove every shipped Fedimint gateway credential (FED-07)

Six code paths configured the Lightning gateway with a bcrypt hash committed
to this repository — and one deploy path with a plaintext password literal —
whenever the per-install secret was missing. Anyone holding a copy of the repo
held the admin credential for every gateway that ever took a fallback.

container::secrets now owns the credential end to end: ensure_gateway_credential
(idempotent, delegates to ensure_one's bcrypt arm) and gateway_bcrypt_hash,
which returns Err when the secret is missing/empty and when the stored value is
on the KNOWN_DEFAULT_GATEWAY_HASHES denylist — so this codebase cannot hand
back the compromised value even to a node already carrying it.

get_app_config was widened to Result so a credential-less install cannot reach
podman run at all; configure_fedimint_lnd takes the resolved hash instead of
re-reading with its own fallback. The four shell paths stop generating
credentials entirely (dropping the htpasswd host dependency) and skip container
creation with a printed reason rather than substituting anything.

Naming converges on the manifest's fedimint-gateway-hash/.pw, with legacy
fedimint-gateway-password values copied forward rather than regenerated so no
node loses a working unique credential. Plan 01-16 owns rotation of installs
already carrying the default.

Verified: cargo build clean; cargo test -p archipelago 999 passed (2
boot_reconciler timing tests failed under concurrent load, green in isolation,
untouched by this diff); bash -n clean on all five scripts; the compromised
literal now appears exactly once in the tree, as the denylist.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/reconcile-containers.sh

@@ -409,6 +409,12 @@ reconcile() {
     return
   fi
 
+  if [ -n "$SPEC_SKIP_REASON" ]; then
+    skip "$name — $SPEC_SKIP_REASON"
+    COUNT_SKIPPED=$((COUNT_SKIPPED + 1))
+    return
+  fi
+
   [ "$name" = "portainer" ] && ensure_portainer_host_paths
 
   # Filter by tier
@@ -693,19 +699,31 @@ ensure_secrets() {
     fi
   done
 
-  if [ ! -f "$SECRETS_DIR/fedimint-gateway-password" ]; then
-    if ! $CHECK_ONLY; then
-      local fpass
-      fpass=$(openssl rand -base64 16)
-      echo "$fpass" | sudo tee "$SECRETS_DIR/fedimint-gateway-password" >/dev/null
-      sudo chmod 600 "$SECRETS_DIR/fedimint-gateway-password"
-      if command -v htpasswd >/dev/null 2>&1; then
-        htpasswd -bnBC 10 "" "$fpass" | tr -d ':\n' | sudo tee "$SECRETS_DIR/fedimint-gateway-hash" >/dev/null
-        sudo chmod 600 "$SECRETS_DIR/fedimint-gateway-hash"
-      fi
-      info "Generated fedimint gateway secret"
+  # FED-07: the gateway's bcrypt credential is generated by the daemon's
+  # container::secrets::ensure_gateway_credential (bcrypt, 0600, idempotent,
+  # self-healing) — this script no longer generates it locally (that removed
+  # the htpasswd host dependency AND the shipped-default fallback that used
+  # to fire when htpasswd was absent). It never shipped, and never ships,
+  # a fallback value.
+  #
+  # Legacy migration only: earlier builds wrote the plaintext under
+  # fedimint-gateway-password instead of the manifest's canonical
+  # fedimint-gateway-hash.pw name. Carry a pre-existing value forward under
+  # the canonical name rather than regenerating (migrations never destroy
+  # data or rotate a working credential); the legacy file is left in place —
+  # plan 01-16 owns its retirement.
+  if [ -f "$SECRETS_DIR/fedimint-gateway-password" ] && [ ! -f "$SECRETS_DIR/fedimint-gateway-hash.pw" ]; then
+    if $CHECK_ONLY; then
+      info "Would migrate legacy fedimint-gateway-password -> fedimint-gateway-hash.pw"
+    else
+      sudo cp "$SECRETS_DIR/fedimint-gateway-password" "$SECRETS_DIR/fedimint-gateway-hash.pw"
+      sudo chmod 600 "$SECRETS_DIR/fedimint-gateway-hash.pw"
+      info "Migrated legacy fedimint-gateway-password -> fedimint-gateway-hash.pw"
     fi
   fi
+  if [ ! -f "$SECRETS_DIR/fedimint-gateway-hash" ]; then
+    info "fedimint-gateway credential not yet generated — the daemon will generate a per-install bcrypt hash (no shipped default); the gateway container is skipped until then"
+  fi
 
   # Reload after generation
   detect_environment