Move config files to /etc/micronas/, fix WebDAV passwd permissions

- /etc/micronas.env      → /etc/micronas/micronas.env
- /etc/micronas-webdav.passwd → /etc/micronas/webdav.passwd
- _save_credentials creates /etc/micronas/ if missing
- _write_webdav_conf: chown root:www-data on passwd file so Apache can read it
- micronas.service EnvironmentFile updated
- README: credentials now set via /setup, config dir step added

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -44,16 +44,15 @@ python3 -m venv /opt/micronas/venv
 /opt/micronas/venv/bin/pip install flask gunicorn
 ```
 
-### 4. Credentials
+### 4. Config directory
 
 ```bash
-cat > /etc/micronas.env <<EOF
-MICRONAS_USER=admin
-MICRONAS_PASS=changeme
-EOF
-chmod 600 /etc/micronas.env
+mkdir -p /etc/micronas
+chmod 700 /etc/micronas
 ```
 
+Credentials are set on first login via the `/setup` page in the browser. No manual env file editing needed.
+
 ### 5. systemd service
 
 ```bash
@@ -93,7 +92,7 @@ Note: SMB/NFS/user management calls require root and the relevant daemons — ru
 
 ## Auth
 
-All routes require a login session. Go to `http://<lxc-ip>:5000` — you will be redirected to the login page automatically. Credentials come from `MICRONAS_USER` / `MICRONAS_PASS` in `/etc/micronas.env`. If `MICRONAS_PASS` is not set the app starts unprotected and logs a warning — do not do this in production.
+All routes require a login session. On first run you are redirected to `/setup` to create the admin account. Credentials are stored hashed in `/etc/micronas/micronas.env`. The WebDAV htpasswd file lives at `/etc/micronas/webdav.passwd` (readable by `www-data`, not world-readable).
 
 ---