- getDailyRecoveryToken(): HMAC of SESSION_SECRET + current day — changes every 24h, requires no extra storage - Logs token to console on startup (visible in CasaOS container logs) - GET/POST /dashboard/recover: validates token, sets new password - dashboard-recover.html: enter token + new password, with instructions - dashboard-login.html: 'Forgot password?' link + success message after recovery Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>