v0.279.0: after_install (decision 45), known default logins on the page, Part D empty-backup alarm, night chain (R-705), R-706

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/metadata.go

@@ -52,8 +52,11 @@ type Metadata struct {
 	// app's kept data (a database from a backup under files kept on the drive) — for an app whose own
 	// index of its files must be rebuilt. Measured on nextcloud: a file written after the backup is on
 	// the drive and invisible until `occ files:scan --all`. Optional; absent = nothing runs.
-	AfterLoad    *AfterLoadCommand `yaml:"after_load,omitempty" json:"after_load,omitempty"`
-	Integrations []IntegrationDef  `yaml:"integrations,omitempty" json:"integrations,omitempty"`
+	AfterLoad *AfterLoadCommand `yaml:"after_load,omitempty" json:"after_load,omitempty"`
+	// AfterInstall (v0.279.0, `09` §3 decision 45) is ONE command the box runs once after a FRESH install —
+	// to replace a known default login with the generated one. See after_install.go.
+	AfterInstall *AfterInstallCommand `yaml:"after_install,omitempty" json:"after_install,omitempty"`
+	Integrations []IntegrationDef     `yaml:"integrations,omitempty" json:"integrations,omitempty"`
 	// InitialCreds: for apps that auto-generate a first-login credential into a file inside the
 	// container (e.g. Crafty's default-creds.txt). The controller reads + parses that file live and
 	// surfaces it on the app page, so the customer never has to dig through logs. Optional.