docs: correct the "default password123" claim — production nodes have none

The walkthrough told new users to log in with `password123` and said they'd
be "prompted to change this password immediately". Neither is true on a
release build:

- `AuthManager::ensure_default_user` is never called. `main.rs:356-362`
  says so explicitly ("Don't auto-create default user — let onboarding flow
  handle password setup via auth.setup"), and the function is `#[allow(dead_code)]`.
- The only `password123` login path is `api/rpc/auth.rs:36-46`, which is
  `#[cfg(debug_assertions)]` AND `dev_mode` AND only fires *before* setup —
  no release binary carries it.
- `Login.vue` calls `auth.isSetup` on mount and renders the "Set Up Your
  Node" password-creation form when it returns false. That is the real
  first-boot screen, and it is the only `auth.setup` caller in the frontend.

So there is nothing to be "prompted to change" — the user creates the
password themselves, and the doc's version taught them to look for a
default that does not exist.

Fixed in four places:
- user-walkthrough Step 8 rewritten as "Create Your Password"
- troubleshooting's "Default password is password123" solution replaced,
  including the warning that deleting user.json does NOT recover a lost
  password (the onboarding gate refuses auth.setup on a provisioned node)
- api-reference cURL example uses a placeholder, not the fake default
- 1.8.0 hardening plan's "kill default credentials" item now reflects that
  the web half is done and only the SSH defaults still ship

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/api-reference.md

@@ -381,10 +381,11 @@ All endpoints use JSON-RPC over HTTP POST to `/rpc/v1`.
 ## Example: cURL
 
 ```bash
-# Login
+# Login (the password you created on the node's first-boot setup screen —
+# there is no default password)
 curl -c cookies.txt -X POST http://archipelago.local/rpc/v1 \
   -H "Content-Type: application/json" \
-  -d '{"method":"auth.login","params":{"password":"password123"}}'
+  -d '{"method":"auth.login","params":{"password":"YOUR_NODE_PASSWORD"}}'
 
 # Get system stats (authenticated)
 curl -b cookies.txt -X POST http://archipelago.local/rpc/v1 \