openhop/repeater: fixes from first real deploy on ubuntuHEADmain

- create spi/gpio groups and udev device rules (Raspberry Pi OS ships them, Ubuntu does not)
- hardware CS via spidev (cs_pin -1); a manual cs_pin on a kernel-owned CE line fails EBUSY
- align RAK6421 pin maps with upstream's hardware catalog: en_pins for the FEM enables,
  gpiod backend on chip 0 (catalog says chip 1, wrong for Pi 4)
- us RF preset is now MeshCore USA/Canada (Recommended): 910.525 / SF7 / BW62.5 / CR5
- set storage.storage_dir; omit mqtt_brokers entirely (any key enables the MQTT pusher)
- fetch radio-settings/radio-presets json into the data dir (pip omits them and the web
  setup wizard's hardware step is empty without them)
- config deployed 0660 with a vaultable repeater.security block so the daemon can persist
  credentials and re-templates no longer wipe them
- sudoers rule so the web UI can restart the service after config changes

1 files changed, 7 insertions, 0 deletions

diff --git a/openhop/repeater/defaults/main.yaml b/openhop/repeater/defaults/main.yaml
index d26e73e..b72dcfb 100644
--- a/openhop/repeater/defaults/main.yaml
+++ b/openhop/repeater/defaults/main.yaml
@@ -12,6 +12,13 @@ repeater_venv_dir: "/opt/openhop_repeater/venv"
 repeater_config_dir: "/etc/openhop_repeater"
 repeater_data_dir: "/var/lib/openhop_repeater"
 
+# --- Web UI credentials (set from vaulted host_vars) ---
+# When null the daemon generates a jwt_secret at startup and requires its setup
+# wizard before login; anything the wizard writes into config.yaml is lost on
+# the next re-template, so real deployments should set both here.
+repeater_admin_password: null
+repeater_jwt_secret: null
+
 # --- Node identity ---
 repeater_node_name: "{{inventory_hostname}}"
 repeater_latitude: 0.0