password & keyring cleanup: one password, one truth, no prompts

The Hub, GDM and sudo now share /etc/shadow as the single source of
truth. /var/lib/secrets/{free,root}-password become root-only display
copies, written only by system_password.py and verified against shadow
before being shown. The GNOME login keyring is decoupled from the login
password (blank master password, pam_gnome_keyring off), so nothing
needs re-keying or wiping when the password changes and the keyring
never pops an unlock prompt.

- add app/sovran_systemsos_web/system_password.py: the single module
  that verifies / sets / displays the free + root passwords and drives
  the legacy-migration onboarding step (same endpoints and UI)
- add modules/password-model.nix: PAM gnome-keyring off, blank
  login.keyring seed with a one-time migration of old encrypted
  keyrings, first-boot-only password application (no more boot-revert),
  LIBCRYPT for the Hub
- server.py: login verifies against shadow and heals stale display
  copies; change-password takes the current password; security reset
  sets both passwords through the same writer (root is shown as a
  password again, not a hash); all keyring wipes removed
- credentials.nix: drop root-password-setup, free-password-setup and
  free-password-migration (replaced by password-model.nix) and the
  keyring wipe in change-free-password
- configuration.nix: drop enableGnomeKeyring and the keyring tmpfiles
  hack (replaced by password-model.nix)
- service-detail.js: "Current password" field; credentials changed
  outside the Hub render with a hint instead of a stale value

Installed machines keep their exact passwords: the first-boot services
no-op once an account has a real hash, and the upgrade never writes
/etc/shadow. The legacy-migration onboarding step and "reset all
passwords" keep working.

configuration.nix

@@ -74,18 +74,6 @@
   services.printing.enable = true;
   systemd.enableEmergencyMode = false;
   environment.gnome.excludePackages = [ pkgs.gnome-tour ];
-  security.pam.services.gdm-password.enableGnomeKeyring = true;
-  security.pam.services.gdm-autologin.enableGnomeKeyring = true;
-
-  # Declaratively guarantee the GNOME Keyring default pointer exists.
-  # Defining the full path ensures root doesn't accidentally lock the user out of .local
-  systemd.tmpfiles.rules = [
-    "d /home/free/.local 0700 free users -"
-    "d /home/free/.local/share 0700 free users -"
-    "d /home/free/.local/share/keyrings 0700 free users -"
-    "f /home/free/.local/share/keyrings/default 0600 free users - login\n"
-  ];
-
 
   # ── Audio ──────────────────────────────────────────────────
   services.pulseaudio.enable = false;