Security Hardening: Ephemeral CA and Default Credential Removal

[tyronechrisharris]

This submission implements security hardening measures for the OSCAR system. Key changes include the removal of all default hardcoded credentials, the implementation of a runtime Ephemeral CA for automatic TLS certificate generation, and a mandatory Setup Wizard for initial system configuration. The Root CA private key is never persisted to disk, and the leaf certificate is secured with a random password stored in a file with restricted permissions. Redirection logic ensures that users must initialize the system before accessing the administrative interface or client.

Fixes #29

---

PR created automatically by Jules for task 16606973887661840686 started by @tyronechrisharris

---

🔄 Auto-Distributed via Sync

Original Flat Repo PR: tyronechrisharris/oscar-flat#38

🔗 Related Updates in this Sync:

• Security Hardening: Ephemeral CA and Default Credential Removal earocorn/osh-core#5
• Security Hardening: Ephemeral CA and Default Credential Removal opensensorhub/osh-addons#175
• Security Hardening: Ephemeral CA and Default Credential Removal #264
• Security Hardening: Ephemeral CA and Default Credential Removal osh-oakridge-modules#164
• Update OSCAR submodule pointers for: Security Hardening: Ephemeral CA and Default Credential Removal osh-oakridge-buildnode#128