fix(iso): stop printing a web password that doesn't work

The installer's completion screen and the login-console banner both told the
operator "Web Login password123". No release build accepts that password: no
default account is ever created (`main.rs:356-362`), and the `password123`
pre-setup path is `#[cfg(debug_assertions)]` + `dev_mode`
(`api/rpc/auth.rs:36-46`). A new user following the screen gets
"User not set up. Please complete setup first." on their first-ever
interaction with the product.

Both screens now say the web UI asks you to create a password on first visit,
which is what `Login.vue` actually does when `auth.isSetup` returns false. The
SSH line is unchanged — `archipelago`/`archipelago` really does still ship
(`install-to-disk.sh:205`), and killing that is the open half of the
"kill default credentials" hardening item.

Note on the path: `image-recipe/build-debian-iso.sh` is a thin wrapper that
copies `_archived/build-auto-installer-iso.sh` and rewrites its relative
paths, so despite the directory name the archived builder is the live one.

Same string fixed in scripts/install-tui-demo.sh, which mirrors the screen.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/install-tui-demo.sh

@@ -587,7 +587,7 @@ screen_complete() {
     p "  ${WHITE}Password  archipelago${NC}"
     row=$((row + 1))
     goto $row 1
-    p "  ${WHITE}Web Login password123${NC}"
+    p "  ${WHITE}Web Login create your password on first visit${NC}"
     row=$((row + 2))
 
     goto $row 1; hrule; row=$((row + 2))