Auth: rate limiter, WebAuthn domain awareness, misc fixes

- Rate limiter tracks failures only; success resets counter
- Record failures/successes after password verification, not before
- WebAuthn rp_id/origin resolved dynamically from request domain
- Management domains auto-discovered from nginx backend config
- All WebAuthn operations validate domain against management list
- Add GET /api/auth/webauthn/capable endpoint for frontend checks
- Frontend checkWebAuthnCapable() function for domain-gated UI
- Timing side-channel fix: pre-compute dummy hash at module load
- Builtin admin seeded with random password (logged at WARNING)
- Logout handler returns consistent response shape

lib/db.py

@@ -292,8 +292,10 @@ def _seed_builtin_admin(db: Database) -> None:
     if rows:
         return
 
-    # Create with a placeholder password that should be changed
-    placeholder_hash = hash_password("CHANGEME")
+    # Generate a random password — this fallback should only fire if
+    # bootstrap_auth.py was skipped. Log the password prominently.
+    random_password = secrets.token_urlsafe(24)
+    placeholder_hash = hash_password(random_password)
     jwt_secret = secrets.token_urlsafe(32)
 
     with db.in_transaction() as tx:
@@ -303,7 +305,11 @@ def _seed_builtin_admin(db: Database) -> None:
         for subsystem in ALL_SUBSYSTEMS:
             tx.run(Q_UPSERT_PERMISSION, (BUILTIN_ADMIN_USERNAME, subsystem, "rw"))
 
-    logger.info("Builtin admin user created with full access")
+    logger.warning(
+        "Builtin admin user created. THIS IS A FALLBACK — bootstrap_auth.py "
+        "should have run during install. Admin password: %s",
+        random_password,
+    )
 
 
 def reset_db_for_test() -> None: