v0.280.0: the setup gate (decision 46); R-710 'I changed it' + absent-record window; R-709 password fields off the page; password:N:special generator

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -1920,6 +1920,21 @@ that folder is never a dead end, and an install never runs into it silently (R-6
   command in the app's own container after a FRESH install (never after a restore or a kept-data load), with the named
   deploy values filled into `${NAME}`; the output must carry `success`. Recorded in `app.yaml` `after_install`; the app
   page hides the default-login card once it succeeded and warns while a default login is in effect.
+  **v0.280.0 (R-710):** an absent record means "not run yet" only for 30 minutes after the install (an app installed
+  before its template gained the command is warned), and the card has "I changed it" (`POST /apps/<slug>/default-login/changed`
+  → `app.yaml` `default_login`), after which the card goes.
+- **The setup gate (v0.280.0, decision 46)** — `.felhom.yml` `setup_gate: true` + optional `setup_done_probe: {url, field,
+  done}`. A FRESH install is closed to everyone but the household: the traefik file
+  `<stacks>/traefik/dynamic/setup-gate-<app>.yml` is written BEFORE the first start (a failed write refuses the install) and
+  puts `forwardAuth` (`/__felhom_gate/auth`, answered before the host check in `CatchAllMiddleware`) in front of every
+  router the app's labels publish. A browser without a gate cookie goes to `felhom.<domain>/__gate/start`; a valid
+  dashboard session gets a 60 s one-use token for that app host, swapped on the app host for a host-only cookie
+  (HMAC key `<data>/setup-gate.key`). The loop (`RunSetupGateLoop`, 20 s) rewrites a missing file, removes files nobody
+  owns, and opens a gate whose probe says done; the household's „Kész, beállítottam" (`POST /apps/<slug>/setup-gate/open`)
+  opens one without a probe. Opening writes the record, then removes the file. A restore keeps the record; a kept-data
+  load never gates. Code: `internal/stacks/setup_gate.go`, `internal/web/setup_gate.go`.
+- **R-709 (v0.280.0).** An installed app's `type: password` value is not in its settings page; the eye fetches it.
+- **`generate: password:N:special` (v0.280.0)** — a lower, an upper, a digit and one of `-_.!@#%+=` (calibre-web's policy).
 - **R-704 (v0.278.0).** A new install (plain or "use my kept data") drops an update or crash-loop hold left by an EARLIER
   install of the app, and a removal clears both kinds; a restore hold (R-379) stays operator-cleared.
 - **R-690 (fixed here).** The removed-app restore (R-487) never found a unit on a DATA drive — it asked