Add dashboard password recovery via daily server-log token

- getDailyRecoveryToken(): HMAC of SESSION_SECRET + current day — changes
  every 24h, requires no extra storage
- Logs token to console on startup (visible in CasaOS container logs)
- GET/POST /dashboard/recover: validates token, sets new password
- dashboard-recover.html: enter token + new password, with instructions
- dashboard-login.html: 'Forgot password?' link + success message after recovery

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/public/dashboard-login.html

@@ -30,6 +30,7 @@ button:hover { opacity: 0.88; }
   <h1>Station Dashboard</h1>
   <p class="sub">Sign in to view your weather data</p>
   <div id="err" class="error" style="display:none">Incorrect username or password.</div>
+  <div id="ok" style="display:none;background:rgba(60,160,80,0.12);border:1px solid #3ca050;border-radius:8px;padding:0.6rem 0.8rem;margin-bottom:1rem;font-size:0.9rem;color:#3ca050">Password updated — sign in with your new password.</div>
   <form method="POST" action="/dashboard/login">
     <label>Username</label>
     <input name="username" type="text" autocomplete="username" autofocus required>
@@ -37,9 +38,11 @@ button:hover { opacity: 0.88; }
     <input name="password" type="password" autocomplete="current-password" required>
     <button type="submit">Sign In</button>
   </form>
+  <a href="/dashboard/recover" style="display:block;text-align:center;margin-top:1.25rem;font-size:0.85rem;color:var(--border);text-decoration:none" onmouseover="this.style.color='var(--ink)'" onmouseout="this.style.color='var(--border)'">Forgot password?</a>
 </div>
 <script>
   if (location.search.includes('error=1')) document.getElementById('err').style.display = 'block';
+  if (location.search.includes('recovered=1')) document.getElementById('ok').style.display = 'block';
 </script>
 </body>
 </html>

app/public/dashboard-recover.html

@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Station Dashboard — Recover Access</title>
+<style>
+*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+:root {
+  --ink: #1a1a1a; --paper: #f5f2ec; --paper-dark: #ece7db;
+  --border: #b9ae9b; --accent: #c25a2a; --mono: 'Segoe UI Rounded', 'Trebuchet MS', sans-serif;
+}
+@media (prefers-color-scheme: dark) {
+  :root { --ink: #ece7dc; --paper: #191510; --paper-dark: #201c16; --border: #3a342a; --accent: #e07848; }
+}
+html, body { min-height: 100%; background: var(--paper); color: var(--ink); font-family: var(--mono); display: flex; align-items: center; justify-content: center; }
+.card { background: var(--paper-dark); border: 1px solid var(--border); border-radius: 16px; padding: 2.5rem 2rem; width: min(400px, 94vw); }
+h1 { font-size: 1.4rem; margin-bottom: 0.25rem; }
+.sub { color: var(--border); font-size: 0.85rem; margin-bottom: 1.5rem; }
+.hint { background: rgba(185,174,155,0.2); border: 1px solid var(--border); border-radius: 8px; padding: 0.75rem 0.9rem; margin-bottom: 1.5rem; font-size: 0.82rem; line-height: 1.6; opacity: 0.85; }
+.hint code { font-family: monospace; background: rgba(185,174,155,0.3); padding: 0.1em 0.35em; border-radius: 4px; font-size: 0.95em; }
+label { display: block; font-size: 0.85rem; margin-bottom: 0.35rem; opacity: 0.7; }
+input { width: 100%; padding: 0.6rem 0.8rem; background: var(--paper); border: 1px solid var(--border); border-radius: 8px; color: var(--ink); font-size: 1rem; font-family: var(--mono); margin-bottom: 1rem; }
+input:focus { outline: 2px solid var(--accent); }
+button { width: 100%; padding: 0.7rem; background: var(--accent); color: #fff; border: none; border-radius: 8px; font-size: 1rem; font-family: var(--mono); cursor: pointer; font-weight: 600; }
+button:hover { opacity: 0.88; }
+.error { background: rgba(194,90,42,0.15); border: 1px solid var(--accent); border-radius: 8px; padding: 0.6rem 0.8rem; margin-bottom: 1rem; font-size: 0.9rem; color: var(--accent); }
+.back { display: block; text-align: center; margin-top: 1.25rem; font-size: 0.85rem; color: var(--border); text-decoration: none; }
+.back:hover { color: var(--ink); }
+</style>
+</head>
+<body>
+<div class="card">
+  <h1>Recover Access</h1>
+  <p class="sub">Reset your dashboard password</p>
+  <div class="hint">
+    Find your recovery token in the server logs — look for a line that says<br>
+    <code>Dashboard recovery token:</code><br>
+    In CasaOS, open the app's log from the container details panel. The token changes daily.
+  </div>
+  <div id="err" class="error" style="display:none">Invalid token or password too short (min 6 chars).</div>
+  <form method="POST" action="/dashboard/recover">
+    <label>Recovery Token</label>
+    <input name="token" type="text" autocomplete="off" spellcheck="false" autofocus required placeholder="Paste token from server logs">
+    <label>New Password</label>
+    <input name="password" type="password" autocomplete="new-password" required minlength="6">
+    <button type="submit">Set New Password</button>
+  </form>
+  <a href="/dashboard/login" class="back">← Back to sign in</a>
+</div>
+<script>
+  if (location.search.includes('error=1')) document.getElementById('err').style.display = 'block';
+</script>
+</body>
+</html>

app/server.js

@@ -62,6 +62,11 @@ function hashPassword(password, salt) {
   return crypto.pbkdf2Sync(password, salt, 100000, 64, 'sha512').toString('hex');
 }
 
+function getDailyRecoveryToken() {
+  const day = Math.floor(Date.now() / (24 * 60 * 60 * 1000));
+  return crypto.createHmac('sha256', SESSION_SECRET).update('recover:' + day).digest('hex').slice(0, 16);
+}
+
 function requireDashboardAuth(req, res, next) {
   const cookies = parseCookies(req);
   const user = verifySession(cookies.dsession);
@@ -856,6 +861,27 @@ app.get('/dashboard/logout', (_req, res) => {
   res.redirect('/dashboard/login');
 });
 
+// Password recovery
+app.get('/dashboard/recover', (_req, res) => {
+  if (!dashAuth) return res.redirect('/dashboard/setup');
+  res.sendFile(path.join(__dirname, 'public', 'dashboard-recover.html'));
+});
+
+app.post('/dashboard/recover', (req, res) => {
+  if (!dashAuth) return res.redirect('/dashboard/setup');
+  const { token, password } = req.body || {};
+  if (!token || !password || password.length < 6) return res.redirect('/dashboard/recover?error=1');
+  const expected = getDailyRecoveryToken();
+  let match = false;
+  try { match = crypto.timingSafeEqual(Buffer.from(token.trim()), Buffer.from(expected)); } catch {}
+  if (!match) return res.redirect('/dashboard/recover?error=1');
+  const salt = crypto.randomBytes(16).toString('hex');
+  const hash = hashPassword(password, salt);
+  dashAuth = { ...dashAuth, salt, hash };
+  try { fs.writeFileSync(DASH_AUTH_FILE, JSON.stringify(dashAuth)); } catch {}
+  res.redirect('/dashboard/login?recovered=1');
+});
+
 // Main dashboard
 app.get('/dashboard', requireDashboardAuth, (_req, res) => {
   if (!dashAuth) return res.redirect('/dashboard/setup');
@@ -1144,4 +1170,10 @@ app.get('/api/conditions/public', (_req, res) => {
   res.json(cached?.data?.[0]?.lastData || null);
 });
 
-app.listen(PORT, () => console.log(`Weather app running on port ${PORT}`));
+app.listen(PORT, () => {
+  console.log(`Weather app running on port ${PORT}`);
+  if (dashAuth) {
+    console.log(`Dashboard recovery token (changes daily): ${getDailyRecoveryToken()}`);
+    console.log(`  Use at http://localhost:${PORT}/dashboard/recover`);
+  }
+});