fix(web): keep generated passwords out of page source

internal/server/web/static/app.js

@@ -36,3 +36,11 @@ document.addEventListener("click", async function (event) {
     // The downloadable JSON link remains available when clipboard access is unavailable.
   }
 });
+
+const oneTimeSecret = document.querySelector("[data-one-time-secret-url]");
+if (oneTimeSecret) {
+  fetch(oneTimeSecret.dataset.oneTimeSecretUrl, { method: "POST", credentials: "same-origin", headers: { "X-CSRF-Token": oneTimeSecret.dataset.csrfToken } })
+    .then(async function (response) { if (!response.ok) throw new Error("one-time secret unavailable"); return response.json(); })
+    .then(function (data) { oneTimeSecret.querySelector(".one-time-secret").textContent = data.password; })
+    .catch(function () { oneTimeSecret.querySelector(".one-time-secret").textContent = "—"; });
+}

internal/server/web/templates/admin_password_result.html

@@ -2,7 +2,7 @@
 {{define "content"}}
 <section class="admin-shell">{{template "admin_nav" .}}<div class="admin-content narrow-content">
   <p class="eyebrow">{{t .Locale "admin.resultTitle"}}</p><h1>{{t .Locale "admin.resetPassword"}}</h1>
-  <section class="card panel warning"><p>{{t .Locale "admin.oneTimePasswordNotice"}}</p><code class="one-time-secret">{{.OneTimeSecret}}</code><p>{{t .Locale "admin.oneTimePasswordHint"}}</p></section>
+  <section class="card panel warning" data-one-time-secret-url="/admin/password-result/secret" data-csrf-token="{{.CSRF}}"><p>{{t .Locale "admin.oneTimePasswordNotice"}}</p><code class="one-time-secret" aria-live="polite">{{t .Locale "common.loading"}}</code><p>{{t .Locale "admin.oneTimePasswordHint"}}</p></section>
   <a class="button secondary" href="/admin/users">{{t .Locale "admin.users"}}</a>
 </div></section>
 {{end}}