Phase 5: secure credentials, first-login setup, user rename, admin settings

Security:
- PBKDF2-HMAC-SHA256 password hashing (260k iterations, random salt per password)
- Legacy MICRONAS_PASS plaintext still works for existing installs
- MICRONAS_PASS_HASH replaces plaintext in env file after first setup/change
- Timing-safe comparison via hmac.compare_digest

First-login setup:
- /setup route: shown when no credentials configured (fresh install)
- Replaces editing /etc/micronas.env manually
- setup.html dark-themed form matching login.html

Admin credential change:
- POST /api/admin/credentials (requires current password to confirm)
- Settings button in topbar opens modal for username + password change
- Session cleared after change → redirected to login

User management:
- PATCH /api/users/<name>: rename Linux user (usermod -l)
  SMB + WebDAV entries removed, password reset required after rename
- Rename button in users table, modal with yellow warning

WebDAV:
- Options Indexes: directories now browsable in a regular web browser

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

templates/setup.html

@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>MicroNAS — Setup</title>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5/dist/css/bootstrap.min.css">
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/app.css') }}">
+    <style>
+        body { display: flex; align-items: center; justify-content: center; min-height: 100vh; }
+        .setup-card { width: 100%; max-width: 400px; }
+    </style>
+</head>
+<body>
+<div class="setup-card">
+    <div class="text-center mb-4">
+        <div class="fw-bold fs-4" style="color:var(--text)">MicroNAS</div>
+        <div class="small" style="color:var(--muted)">First-time setup — create your admin account</div>
+    </div>
+    <div class="card">
+        <div class="card-body p-4">
+            {% if error %}
+            <div class="alert mb-3 py-2 px-3" style="background:#2d1515; border:1px solid var(--red); color:var(--red); border-radius:6px; font-size:.9rem;">
+                {{ error }}
+            </div>
+            {% endif %}
+            <form method="POST">
+                <div class="mb-3">
+                    <label class="form-label" style="color:var(--muted); font-size:.85rem">Admin Username</label>
+                    <input type="text" name="username" class="form-control" value="{{ username or 'admin' }}" autofocus autocomplete="username">
+                </div>
+                <div class="mb-3">
+                    <label class="form-label" style="color:var(--muted); font-size:.85rem">Password</label>
+                    <input type="password" name="password" class="form-control" autocomplete="new-password">
+                </div>
+                <div class="mb-4">
+                    <label class="form-label" style="color:var(--muted); font-size:.85rem">Confirm Password</label>
+                    <input type="password" name="confirm" class="form-control" autocomplete="new-password">
+                </div>
+                <button type="submit" class="btn btn-primary w-100">Create Account</button>
+            </form>
+        </div>
+    </div>
+    <div class="text-center mt-3" style="font-size:.8rem; color:var(--muted)">
+        Credentials are saved hashed to <code>/etc/micronas.env</code>
+    </div>
+</div>
+</body>
+</html>