== before
demo-felhom-8363b5 HTTP 200 user root@pam set_at 2026-07-18T16:30:41Z password_len 32
192.168.0.162 PVE ticket HTTP 200 ticket_issued True
== rotate (installer step 4b alone, on demo-felhom)
[STEP] 4b/8 break-glass credential (root@pam console password → hub vault)
[OK]     root@pam password set + vaulted to the hub (retrieve via the operator /admin path; never logged here)
[WARN]   NOTE: the root@pam password just CHANGED — the old one now fails at the PVE web GUI (:8006).
[WARN]         Retrieve the new one at hub → host page (vaulted recovery credential).
== after (hub 0.157.0: set_at should move now)
demo-felhom-8363b5 HTTP 200 user root@pam set_at 2026-10-17T15:10:04Z password_len 32
== the NEW vaulted value logs in
192.168.0.162 PVE ticket HTTP 200 ticket_issued True
== the OLD value no longer does
192.168.0.162 PVE ticket HTTP 401
values differ: yes
