v0.280.0: the setup gate (decision 46); R-710 'I changed it' + absent-record window; R-709 password fields off the page; password:N:special generator

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/metadata.go

@@ -56,7 +56,12 @@ type Metadata struct {
 	// AfterInstall (v0.279.0, `09` §3 decision 45) is ONE command the box runs once after a FRESH install —
 	// to replace a known default login with the generated one. See after_install.go.
 	AfterInstall *AfterInstallCommand `yaml:"after_install,omitempty" json:"after_install,omitempty"`
-	Integrations []IntegrationDef     `yaml:"integrations,omitempty" json:"integrations,omitempty"`
+	// SetupGate (v0.280.0, `09` §3 decision 46): a fresh install is CLOSED to everyone but the household until the
+	// app's first setup is done — for an app whose first visitor creates the admin. See setup_gate.go.
+	SetupGate bool `yaml:"setup_gate,omitempty" json:"setup_gate,omitempty"`
+	// SetupDoneProbe (v0.280.0) is the app's own read-only "an admin exists" status; absent = the household's button.
+	SetupDoneProbe *SetupDoneProbe  `yaml:"setup_done_probe,omitempty" json:"setup_done_probe,omitempty"`
+	Integrations   []IntegrationDef `yaml:"integrations,omitempty" json:"integrations,omitempty"`
 	// InitialCreds: for apps that auto-generate a first-login credential into a file inside the
 	// container (e.g. Crafty's default-creds.txt). The controller reads + parses that file live and
 	// surfaces it on the app page, so the customer never has to dig through logs. Optional.