Add dashboard password recovery via daily server-log token

- getDailyRecoveryToken(): HMAC of SESSION_SECRET + current day — changes
  every 24h, requires no extra storage
- Logs token to console on startup (visible in CasaOS container logs)
- GET/POST /dashboard/recover: validates token, sets new password
- dashboard-recover.html: enter token + new password, with instructions
- dashboard-login.html: 'Forgot password?' link + success message after recovery

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/public/dashboard-login.html

@@ -30,6 +30,7 @@ button:hover { opacity: 0.88; }
   <h1>Station Dashboard</h1>
   <p class="sub">Sign in to view your weather data</p>
   <div id="err" class="error" style="display:none">Incorrect username or password.</div>
+  <div id="ok" style="display:none;background:rgba(60,160,80,0.12);border:1px solid #3ca050;border-radius:8px;padding:0.6rem 0.8rem;margin-bottom:1rem;font-size:0.9rem;color:#3ca050">Password updated — sign in with your new password.</div>
   <form method="POST" action="/dashboard/login">
     <label>Username</label>
     <input name="username" type="text" autocomplete="username" autofocus required>
@@ -37,9 +38,11 @@ button:hover { opacity: 0.88; }
     <input name="password" type="password" autocomplete="current-password" required>
     <button type="submit">Sign In</button>
   </form>
+  <a href="/dashboard/recover" style="display:block;text-align:center;margin-top:1.25rem;font-size:0.85rem;color:var(--border);text-decoration:none" onmouseover="this.style.color='var(--ink)'" onmouseout="this.style.color='var(--border)'">Forgot password?</a>
 </div>
 <script>
   if (location.search.includes('error=1')) document.getElementById('err').style.display = 'block';
+  if (location.search.includes('recovered=1')) document.getElementById('ok').style.display = 'block';
 </script>
 </body>
 </html>