feat: one shared device password in a dedicated Security tab

Consolidate the scattered credentials in the web interface:

- The password fields are pulled out of the WiFi, FTP and WebDAV tabs
  into a new "Security" sub-tab. One password now protects the web
  interface, FTP and WebDAV at once: the /security handler fans the value
  out to wwwPassword, ftppassword and webdavPwd and reloads the FTP/WebDAV
  servers live (no reboot). The FTP/WebDAV tabs keep only their username
  and point to the Security tab for the password.
- An empty password is accepted and disables protection for all three.
- The hostname moves out of the WiFi tab to the top of the General tab.
  /wificonfig now does partial updates so saving the hostname no longer
  clobbers the "scan WiFi on start" flag and vice versa.
- The navbar brand now reads just "Leo Industries" (no "AT-1").

Locales (de/en/fr), the Swagger spec (/security, /wificonfig) and the
README are updated. Verified on device: password fan-out to FTP, empty
password disables everywhere, and hostname partial-update keeps scanOnStart.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: fhirschmann

README.md

@@ -108,6 +108,7 @@ neon logo that doubles as the SVG favicon ([`7be5254`](../../commit/7be5254)):
 | **Consolidated, auto-saving Settings tab**: WiFi/MQTT/FTP/Bluetooth merged with the general settings into one tab; the sub-tabs are a **vertical UniFi-style sidebar** (icon-only on mobile; stays pinned while scrolling) with flat, consistent sections, split into General / **Buttons** / **LEDs** / **Power** / **RFID** / … . General/Buttons/LEDs/Power/RFID auto-save (debounced); the credential tabs keep an explicit submit on purpose | [`8b01876`](../../commit/8b01876) · [`1944cf4`](../../commit/1944cf4) · [`c284d0e`](../../commit/c284d0e) · [`32aabfd`](../../commit/32aabfd) |
 | **Configurable branding**: re-brand the navbar header + footer (General → Branding) with a live preview as you type — empty keeps the "Leo Industries" default, so the fork is easy to re-brand | [`fd57fcb`](../../commit/fd57fcb) |
 | **Password protection**: single password (no username), 90-day session cookie, brute-force lockout, logout entry; off in hotspot mode. Scripts/API clients authenticate with the password as an **API key** (`X-API-Key` header / `apikey` query param) | [`e74e712`](../../commit/e74e712) |
+| **One shared device password (Security tab)**: the password fields were pulled out of the WiFi/FTP/WebDAV tabs into a single **Security** sub-tab — one password now protects the web interface, FTP *and* WebDAV (set once, applies everywhere; applied live without a reboot). An **empty password is accepted** and disables protection for all three. The **hostname** moved to the top of the **General** tab (saved on its own; `/wificonfig` now does partial updates) and the navbar brand reads just **Leo Industries** | [`PENDINGHASH2`](../../commit/PENDINGHASH2) |
 | **One-click OTA + version badge**: a Tools-tab button (also bindable command **186** / MQTT `firmware_update`) pulls the rolling `latest` GitHub release and flashes it over OTA; a navbar badge shows the running build and turns amber when an update is available (passive `/version` check) — click it to install | [`8527f5e`](../../commit/8527f5e) · [`b736abc`](../../commit/b736abc) |
 | **HTTP file sync**: pull audio files from a web server onto the SD card from a JSON manifest — additive, streamed in chunks straight to SD, background task with live progress + stop, abort-on-button, stall watchdog, auto-pauses playback and keeps the device awake mid-transfer. The manifest is streamed into the parser to halve peak RAM | [`ac24bbc`](../../commit/ac24bbc) · [`42d2c46`](../../commit/42d2c46) |
 | **WebDAV server**: mount the SD card as a network drive (`http://<ip>:81/`) to copy audio on/off it straight from Finder/Explorer — no FTP client needed. Self-contained server (OPTIONS/PROPFIND/GET/HEAD+ranges/PUT/DELETE/MKCOL/MOVE/COPY/LOCK) running in its own task pinned to core 0 so transfers never disturb the audio pipeline; optional HTTP-Basic credentials. Configure + auto-start on boot in its own **WebDAV** settings sub-tab; start/stop live from the Control tab, command **188** or MQTT `webdav` (Home Assistant switch included). With auto-start on, the share is announced over **Bonjour/mDNS** (`_webdav._tcp`, `path=/`) so it pops up by itself in the Finder/Explorer network sidebar — no manual "Connect to Server" needed (currently disabled — see `WEBDAV_ENABLE`) | [`9b2bee0`](../../commit/9b2bee0) |

REST-API.yaml

@@ -250,10 +250,13 @@ paths:
                   ScanWiFiOnStart:
                     type: boolean
     post:
-      summary: Save current common Wi-Fi configuration.
-      description: Save the current common Wi-Fi configuration settings.
+      summary: Save common Wi-Fi configuration (partial updates allowed).
+      description: >
+        Save the common Wi-Fi configuration. Partial updates are supported: send only
+        "hostname" (saved from the General tab) or only "scanOnStart" (from the WiFi tab);
+        omitted fields are left unchanged.
       requestBody:
-        description: Common Wi-Fi configuration to save.
+        description: Common Wi-Fi configuration to save (any subset of the fields).
         required: true
         content:
           application/json:
@@ -262,11 +265,8 @@ paths:
               properties:
                 hostname:
                   type: string
-                ScanWiFiOnStart:
+                scanOnStart:
                   type: boolean
-              required:
-                - hostname
-                - ScanWiFiOnStart
       responses:
         "200":
           description: Successful Wi-Fi configuration save.
@@ -758,8 +758,11 @@ paths:
                     type: boolean
     post:
       tags: [Fork]
-      summary: Set or clear the web-interface password.
-      description: Sets a new web password (enables protection) or clears it when empty.
+      summary: Set or clear the shared device password (web interface, FTP and WebDAV).
+      description: >
+        Sets one shared password that protects the web interface, FTP and WebDAV at once
+        (applied live, no reboot). An empty password is accepted and disables protection
+        for all three.
       requestBody:
         required: true
         content:

html/locales/de.json

@@ -47,7 +47,8 @@
 		"help": "Hilfe",
 		"rfidcards": "RFID",
 		"leds": "LEDs",
-		"power": "Power"
+		"power": "Power",
+		"security": "Sicherheit"
 	},
 	"settingsex": {
 		"title": "Erweiterte Einstellungen",
@@ -132,11 +133,11 @@
 		}
 	},
 	"security": {
-		"title": "Webinterface-Passwort",
+		"title": "Geräte-Passwort",
 		"password": {
 			"title": "Passwort",
 			"placeholder": "Leer lassen, um den Schutz zu deaktivieren",
-			"desc": "Schützt das Webinterface mit einem Passwort. Nach dem Anmelden bleibt man 90 Tage eingeloggt. Im Hotspot-Modus ist der Schutz inaktiv."
+			"desc": "Ein gemeinsames Passwort für alles: Webinterface, FTP und WebDAV. Nach dem Anmelden im Webinterface bleibt man 90 Tage eingeloggt; im Hotspot-Modus ist der Schutz inaktiv. Leer lassen, um den Schutz überall (Webinterface, FTP, WebDAV) zu deaktivieren."
 		}
 	},
 	"wifi": {
@@ -449,7 +450,8 @@
 		"pwd": {
 			"title": "FTP-Passwort",
 			"placeholder": "Passwort",
-			"show": "Passwort anzeigen/verbergen"
+			"show": "Passwort anzeigen/verbergen",
+			"securityHint": "Das FTP-Passwort wird im Tab \"Sicherheit\" gesetzt (gemeinsames Geräte-Passwort)."
 		},
 		"start": {
 			"title": "FTP-Server starten",
@@ -472,7 +474,7 @@
 			"show": "Passwort anzeigen/verbergen"
 		},
 		"auth": {
-			"hint": "Benutzername und Passwort leer lassen, um ohne Anmeldung zuzugreifen."
+			"hint": "Das WebDAV-Passwort wird im Tab \"Sicherheit\" gesetzt (gemeinsames Geräte-Passwort). Benutzername und Passwort leer lassen, um ohne Anmeldung zuzugreifen."
 		},
 		"start": {
 			"title": "WebDAV-Server starten",

html/locales/en.json

@@ -47,7 +47,8 @@
 		"help": "Help",
 		"rfidcards": "RFID",
 		"leds": "LEDs",
-		"power": "Power"
+		"power": "Power",
+		"security": "Security"
 	},
 	"settingsex": {
 		"title": "Advanced settings",
@@ -132,11 +133,11 @@
 		}
 	},
 	"security": {
-		"title": "Web interface password",
+		"title": "Device password",
 		"password": {
 			"title": "Password",
 			"placeholder": "Leave empty to disable protection",
-			"desc": "Protects the web interface with a password. Once logged in you stay logged in for 90 days. Protection is inactive in hotspot mode."
+			"desc": "One shared password for everything: web interface, FTP and WebDAV. Once logged in to the web interface you stay logged in for 90 days; protection is inactive in hotspot mode. Leave empty to disable protection everywhere (web interface, FTP, WebDAV)."
 		}
 	},
 	"wifi": {
@@ -449,7 +450,8 @@
 		"pwd": {
 			"title": "FTP-password",
 			"placeholder": "password",
-			"show": "Show/hide password"
+			"show": "Show/hide password",
+			"securityHint": "The FTP password is set on the \"Security\" tab (shared device password)."
 		},
 		"start": {
 			"title": "Start FTP-server",
@@ -472,7 +474,7 @@
 			"show": "Show/hide password"
 		},
 		"auth": {
-			"hint": "Leave username and password empty to allow access without a login."
+			"hint": "The WebDAV password is set on the \"Security\" tab (shared device password). Leave username and password empty to allow access without a login."
 		},
 		"start": {
 			"title": "Start WebDAV server",

html/locales/fr.json

@@ -47,7 +47,8 @@
 		"help": "Aide",
 		"rfidcards": "RFID",
 		"leds": "LEDs",
-		"power": "Alim."
+		"power": "Alim.",
+		"security": "Sécurité"
 	},
 	"settingsex": {
 		"title": "Paramètres avancés",
@@ -125,11 +126,11 @@
 		}
 	},
 	"security": {
-		"title": "Mot de passe de l'interface web",
+		"title": "Mot de passe de l'appareil",
 		"password": {
 			"title": "Mot de passe",
 			"placeholder": "Laisser vide pour désactiver la protection",
-			"desc": "Protège l'interface web par un mot de passe. Une fois connecté, vous restez connecté pendant 90 jours. La protection est inactive en mode hotspot."
+			"desc": "Un seul mot de passe partagé pour tout : interface web, FTP et WebDAV. Une fois connecté à l'interface web, vous restez connecté pendant 90 jours ; la protection est inactive en mode hotspot. Laisser vide pour désactiver la protection partout (interface web, FTP, WebDAV)."
 		}
 	},
 	"wifi": {
@@ -442,7 +443,8 @@
 		"pwd": {
 			"title": "Mot de passe FTP",
 			"placeholder": "mot de passe",
-			"show": "Afficher/masquer le mot de passe"
+			"show": "Afficher/masquer le mot de passe",
+			"securityHint": "Le mot de passe FTP se règle dans l'onglet « Sécurité » (mot de passe partagé de l'appareil)."
 		},
 		"start": {
 			"title": "Démarrer serveur FTP",
@@ -465,7 +467,7 @@
 			"show": "Afficher/masquer le mot de passe"
 		},
 		"auth": {
-			"hint": "Laissez le nom d'utilisateur et le mot de passe vides pour un accès sans connexion."
+			"hint": "Le mot de passe WebDAV se règle dans l'onglet « Sécurité » (mot de passe partagé de l'appareil). Laissez le nom d'utilisateur et le mot de passe vides pour un accès sans connexion."
 		},
 		"start": {
 			"title": "Démarrer serveur WebDAV",