feat: show actual credentials on post-deploy success page

Instead of a generic "default creds" message, the post-deploy card now
reads actual username/password values from the deploy form fields and
displays them in a table. Filters out internal DB passwords and secret
keys, showing only user-facing credentials (admin user, admin password).
Falls back to metadata defaultCreds for apps without typed deploy fields.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/templates/deploy.html

@@ -398,7 +398,8 @@ var postDeployInfo = {
     defaultCreds: {{json .Meta.AppInfo.DefaultCreds}},
     docsURL: {{json .Meta.AppInfo.DocsURL}},
     domain: {{json .Domain}},
-    displayName: {{json .Meta.DisplayName}}
+    displayName: {{json .Meta.DisplayName}},
+    deployFields: {{json .Meta.DeployFields}}
 };
 
 function buildPostDeployCard(stackName) {
@@ -427,8 +428,33 @@ function buildPostDeployCard(stackName) {
         html += '</ol></div>';
     }
 
-    // Default creds
+    // Credentials from deploy fields (show actual values from form)
-    if (postDeployInfo.defaultCreds) {
+    var credRows = '';
+    if (postDeployInfo.deployFields) {
+        for (var i = 0; i < postDeployInfo.deployFields.length; i++) {
+            var f = postDeployInfo.deployFields[i];
+            // Show secrets, passwords, and username-like text fields
+            var isCredential = f.type === 'secret' || f.type === 'password';
+            if (!isCredential && f.type === 'text') {
+                var ev = f.env_var.toUpperCase();
+                isCredential = ev.indexOf('USER') >= 0 || ev.indexOf('ADMIN') >= 0 || ev.indexOf('LOGIN') >= 0;
+            }
+            if (!isCredential) continue;
+            // Skip internal DB credentials
+            var evUp = f.env_var.toUpperCase();
+            if (evUp.indexOf('DB_PASSWORD') >= 0 || evUp.indexOf('MYSQL_ROOT') >= 0 || evUp.indexOf('SECRET_KEY') >= 0) continue;
+            // Read value from DOM
+            var el = document.getElementById('auto-field-' + f.env_var) || document.getElementById('field-' + f.env_var);
+            var val = el ? el.value : '';
+            if (!val) continue;
+            credRows += '<tr><td style="padding:.25rem .75rem .25rem 0;color:var(--text-muted);white-space:nowrap">' + f.label + '</td>' +
+                '<td style="padding:.25rem 0;font-family:var(--font-mono);user-select:all">' + val + '</td></tr>';
+        }
+    }
+    if (credRows) {
+        html += '<div class="app-info-card" style="margin-top:1rem"><h4>Bejelentkezés</h4>' +
+            '<table style="margin:.5rem 0">' + credRows + '</table></div>';
+    } else if (postDeployInfo.defaultCreds) {
         var creds = postDeployInfo.defaultCreds.replace(/DOMAIN/g, postDeployInfo.domain);
         html += '<div class="app-info-card" style="margin-top:1rem"><h4>Bejelentkezés</h4>' +
             '<p class="app-info-creds">' + creds + '</p></div>';