GDWhisper/dsh-web-startup-auth

## Core Features
- The plugin replaces the original web startup restriction so dsh web can bind to 0.0.0.0 and serve the browser interface on non-loopback network interfaces.
- It provides a login and registration flow that creates an administrator account on first access and requires subsequent visitors to authenticate.
- Authenticated sessions use a signed dsh_sid cookie with a 14-day lifetime, HttpOnly protection, and SameSite=Lax behavior.
- It protects registered /api/* routes and third-party RPC routes except /api/auth/* and /login, returning 401 or refusing handshakes when no valid session is present.
- It adds an Authentication tab to the DSH settings panel for logging out and changing the password.

## Use Cases
- It supports exposing a DSH web interface to a local network while requiring a username and password before browser access.
- It allows a first visitor on a fresh installation to register the administrator account before later users can log in.
- It lets an operator reset a forgotten password from the server machine and invalidate all previously issued sessions.
- It provides a settings-panel path for authenticated users to log out or change the account password.

## Technical Details
- The package is distributed as a DSH bundle whose dsh.bundle.patch declaration applies cordis.patch.yml automatically when installed through dsh plugin.
- Passwords are stored with Node built-in crypto.scryptSync using random salts, and session cookies are signed with HMAC-SHA256 using a generated key.
- The server-side plugin rewrites Host and Origin values for authenticated requests so loopback-only DSH APIs, third-party RPC channels, and WebSocket upgrades can pass through registered routes.
- A browser-side script injected through webServer.tapIndex overrides the frontend loopback flag after module loading to support settings mirror behavior on remote HTTP clients.

## Notes
- The plugin does not provide transport encryption, so plaintext HTTP credentials and traffic can be observed on the network unless an HTTPS reverse proxy is used.
- The dsh_sid cookie cannot be individually revoked, although changing the password or running auth-reset rotates the session key and invalidates all sessions.
- Before the first administrator account is created, any visitor can register, so initial registration should be completed before exposing the service to untrusted networks.