webui: warn when the device has no password; name the shell honestly

[Rust-KVM]

Requested by 4c · project thread

Summary

Before: with no password set, nothing on the page said that anyone on the network could control the host and open a root shell on the device. The shell was labelled "Serial / Terminal", and Settings only offered "Change password", which needs a current password that does not exist.

After: when the device is in no-password mode, the connect card shows a warning, and after connecting a dismissible banner at the top says the same and points to Settings → Password. The shell is named "Device shell (root)". Settings → Password lets you set the first password directly (no "current password" field). Default auth behaviour is unchanged; this only adds warnings, as chosen by the owner.

How

• net/rest.rs: no_password() reads authMode from GET /device; set_password() calls the existing POST /auth/password-local.
• app.rs: no_password signal loaded at startup and after setup; banner and card warnings; the banner hides until reload when dismissed.
• settings.rs: the password section uses set_password when no password exists and clears the warning on success.
• terminal.rs, toolbar tooltip: renamed to "Device shell (root)".

Testing

• cargo +nightly fmt --all (CI)
• cargo +nightly clippy --workspace --release --all-targets -- -D warnings (CI)
• cargo +nightly test --workspace (CI)
• Frontend touched: trunk build --locked and wasm32 clippy in crates/rkvm-web (CI)
• Tested on an RK3588 device: a build merging all four web UI fix branches (this one and its three siblings) was deployed to the NanoPC-T6; the page returns 200, 4K60 video plays, and the startup log has no WARN/ERROR. Click-through UI retest is pending in the desktop app.

Checklist

• No #[allow(...)] suppressions and no new unwrap() / expect() in production paths
• Hot paths stay zero-copy; periodic loops use MissedTickBehavior::Delay (frontend only)
• Shared protocol types live in rkvm-proto
• RPC method set changed → not applicable (frontend calls existing methods only)
• Module tree or build invariants changed → not applicable

Part of the old-version web UI test report fixes. The four branches touch overlapping files but merge onto dev together without conflicts.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PbdzY6PfT28goR4BhqdsXR

---

Generated by Claude Code