v0.208.0 — R-254: the last two secrets leave the page source, plus a gate against a fourth

Site one. app_info.html rendered {{.InitialCreds.Password}} into a hidden span —
a REAL per-install credential, read live out of the running container, in the
response body of every render. The page now carries the non-secret half plus a
boolean; the value comes from POST /apps/<slug>/initial-credentials/reveal, which
RE-READS the container rather than serving a cached copy (caching it in the
handler would put it back in the body one layer in). no-store, CSRF-covered,
logged as an act. Both buttons go through it. A reveal that cannot read the value
SAYS SO rather than returning an empty string that renders as a blank password.

Site two, established before changing. The hidden input is NOT the defect and was
left alone: it fires only pre-deploy, and README §318 documents why the value must
round-trip — the customer notes the generated secrets down and submitting them
back is what makes the saved value the same one they saw. The defect was the
neighbouring READONLY input, which on an ALREADY-DEPLOYED app rendered the secret
into a page with nothing to submit. Fixed by POST /stacks/<name>/auto-field/reveal,
authorised by requiring a type:secret auto-field of that stack. Both directions
pinned.

The premise that this contradicted a repo rule does not hold: the rule is
CONTEXT.md:2070 'Password fields require explicit input — prevents accidental
empty-password deployments', about EMPTINESS. No line in the repo says 'no silent
auto-fill'.

The gate. scripts/secret_in_markup_gate.py, registered in controller_gates.py,
convicts any template expression that names a secret unless allowlisted with a
reason. Its limits are MEASURED and in its docstring: it catches a launder through
a local variable (the assignment names the secret) but is blind to a secret
arriving under a neutral page-data key — verified both ways. That is the shape of
site two, which this gate would NOT have caught. The runtime body assertion covers
all shapes but only 4 of 27 page templates; the other 23 are R-255, filed rather
than glossed. Two nets, different holes, both named.

Correction to v0.207.0's report: HTML comments do NOT ship in the response body
here — html/template strips them, text/template does not. Measured. A red-proof
planting a secret in a comment therefore correctly does not fail.

controller/internal/web/templates/app_info.html

@@ -180,11 +180,14 @@ function appMigrate(btn,app,label){
             {{end}}
             <tr>
                 <td class="initcred-label" style="padding:.25rem .75rem .25rem 0;color:var(--text-3);white-space:nowrap;vertical-align:middle">Jelszó</td>
+                <!-- R-254: the value is NOT in this page. It used to be rendered into a `hidden`
+                     span, which stops a browser drawing it and nothing else — a fetch of this page
+                     returned a real per-install password. Both buttons now ask the server. -->
                 <td style="display:flex;align-items:center;gap:.5rem;flex-wrap:wrap">
                     <code id="initcred-pw">••••••••••••</code>
-                    <span id="initcred-pw-val" hidden>{{.InitialCreds.Password}}</span>
-                    <button type="button" class="btn btn-sm btn-outline" onclick="icRevealPw(this)">Megjelenítés</button>
+                    <button type="button" class="btn btn-sm btn-outline" id="initcred-reveal" onclick="icRevealPw(this)">Megjelenítés</button>
                     <button type="button" class="btn btn-sm btn-outline" onclick="icCopyPw(this)">Másolás</button>
+                    <span id="initcred-err" class="form-hint" style="display:none;color:var(--red)"></span>
                 </td>
             </tr>
         </table>
@@ -212,33 +215,53 @@ function appMigrate(btn,app,label){
 
 {{if .InitialCreds}}
 <script>
-// Initial-credential password reveal/copy. The value lives in a hidden element (HTML-escaped by the
-// template) so it's never inlined into a JS string literal.
-function icPwVal() {
-    var el = document.getElementById('initcred-pw-val');
-    return el ? el.textContent : '';
+// R-254: the password is NOT in this page. It is fetched on demand from the server, which re-reads it
+// live from the running container — so this is the only way it reaches a browser, and every fetch is
+// recorded server-side. Nothing caches it in a variable between presses: each act asks again.
+function icFetchPw() {
+    return fetch('/apps/{{.Meta.Slug}}/initial-credentials/reveal', {
+        method: 'POST',
+        headers: {'X-CSRF-Token': '{{.CSRFToken}}'},
+        credentials: 'same-origin'
+    }).then(function (r) { return r.json(); }).then(function (j) {
+        if (!j.ok) { throw new Error(j.error || 'A kezdeti jelszó beolvasása nem sikerült.'); }
+        return j.data.password;
+    });
+}
+function icErr(msg) {
+    var e = document.getElementById('initcred-err');
+    e.textContent = msg;
+    e.style.display = 'inline';
 }
 function icRevealPw(btn) {
     var code = document.getElementById('initcred-pw');
     if (!code) return;
-    if (code.dataset.shown === '1') {
+    document.getElementById('initcred-err').style.display = 'none';
+    if (code.dataset.shown === '1') {          // hide: drop the value out of the DOM again
         code.textContent = '••••••••••••';
         code.dataset.shown = '0';
         btn.textContent = 'Megjelenítés';
-    } else {
-        code.textContent = icPwVal();
+        return;
+    }
+    btn.disabled = true;
+    icFetchPw().then(function (pw) {
+        btn.disabled = false;
+        code.textContent = pw;
         code.dataset.shown = '1';
         btn.textContent = 'Elrejtés';
-    }
+    }).catch(function (e) { btn.disabled = false; icErr(e.message); });
 }
 function icCopyPw(btn) {
-    var val = icPwVal();
-    if (!val) return;
-    navigator.clipboard.writeText(val).then(function () {
-        var orig = btn.textContent;
-        btn.textContent = 'Másolva';
-        setTimeout(function () { btn.textContent = orig; }, 1500);
-    });
+    document.getElementById('initcred-err').style.display = 'none';
+    btn.disabled = true;
+    icFetchPw().then(function (pw) {
+        return navigator.clipboard.writeText(pw).then(function () {
+            btn.disabled = false;
+            var orig = btn.textContent;
+            btn.textContent = 'Másolva';
+            setTimeout(function () { btn.textContent = orig; }, 1500);
+        });
+    }).catch(function (e) { btn.disabled = false; icErr(e.message); });
 }
 </script>
 {{end}}