gokapi: reproducible headless setup via seed config + --deployment-password

Gokapi v1.9.6 has no env-var setup and otherwise exposes a public /setup (admin-takeover risk).
Entrypoint seeds config.json on first boot (admin, this app's URL, local storage, no-encryption so
it restarts without a prompt) with password/salts cleared, then runs the documented
--deployment-password one-shot to set the felhom-generated admin password before serving — claims
admin at first boot, never exposes /setup. Seed pinned to v1.9.6 (ConfigVersion 21).

templates/gokapi/.felhom.yml

@@ -32,6 +32,13 @@ deploy_fields:
     locked_after_deploy: true
     description: "Az alkalmazás aldomainje"
 
+  - env_var: GOKAPI_PASSWORD
+    label: "Admin jelszó"
+    type: password
+    generate: "password:24"
+    locked_after_deploy: true
+    description: "A Gokapi admin felhasználó (admin) jelszava — ezzel tudsz belépni a kezelőfelületre"
+
 # --- App info (info page content) ---
 app_info:
   tagline: "Ideiglenes fájlmegosztás lejáró linkekkel"