v0.84.0: catalog-driven initial_credentials — read an app's auto-generated first-login from a file and show it on the app page

CHANGELOG.md

@@ -1,5 +1,30 @@
 ## Changelog
 
+### v0.84.0 — Show an app's auto-generated initial login on its page (catalog-driven) (2026-06-26)
+- **Problem:** some apps generate a random first-login password into a file at first boot (Crafty →
+  `/crafty/app/config/default-creds.txt`) instead of taking it from a deploy field. Customers had to
+  read the container logs to find it — the static `app_info.default_creds` hint can't carry a
+  per-install secret.
+- **General, catalog-driven mechanism (not Crafty-specific):**
+  - `.felhom.yml` gains an optional `initial_credentials` block: `{file, format: json|regex|plain,
+    container?, username_key/password_key (json), username_pattern/password_pattern (regex), note}`.
+  - `internal/stacks/metadata.go`: new `InitialCredentials` struct + `Metadata.InitialCreds` (deep-copied
+    in `deepCopyStack`).
+  - `internal/stacks/initialcreds.go`: `ReadInitialCredentials(stack)` reads the file **live** from the
+    running container (`docker exec <c> cat <file>` — path passed as a single arg, no shell) and parses
+    it via the pure, unit-tested `parseInitialCreds` (json/regex/plain). Never persists the secret to
+    `app.yaml`; returns a non-Available result (card hidden) when the container is down / file missing /
+    parse fails. Container defaults to the stack's main container (`findProbeContainer`).
+  - `internal/web/handlers.go`: `appDetailHandler` populates `InitialCreds` for deployed apps with the
+    spec; `app_info.html` renders a "Kezdeti belépési adatok" card with username + masked password
+    (Megjelenítés/Másolás, value read from a hidden element — never inlined into JS), labelled clearly as
+    the **initial** password (stays valid only until the customer changes it in-app).
+  - Tests: `parseInitialCreds` json/regex/plain + error paths.
+- **Security note:** this surfaces a live working credential on the app page — same exposure class as the
+  existing post-deploy password reveal and `default_creds` card. It relies on the dashboard being
+  auth-gated in production (the demo's public-unauth dashboard is a separate, pre-existing tracked issue).
+- Paired with `app-catalog-felhom.eu` adding the `initial_credentials` block to crafty-controller.
+
 ### v0.83.0 — Traefik scoped serversTransport for self-signed HTTPS backends (fixes crafty 502) (2026-06-26)
 - **Problem:** the crafty-controller healthcheck fix (catalog `68ce009`) un-withheld its Traefik route,
   exposing a pre-existing 502 — Traefik proxied **HTTP** to Crafty's **HTTPS-only** self-signed backend