- getDailyRecoveryToken(): HMAC of SESSION_SECRET + current day — changes
every 24h, requires no extra storage
- Logs token to console on startup (visible in CasaOS container logs)
- GET/POST /dashboard/recover: validates token, sets new password
- dashboard-recover.html: enter token + new password, with instructions
- dashboard-login.html: 'Forgot password?' link + success message after recovery
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
