Setup

Set the Portal password for the first time -- the DIY (open-setup) flow only.

Reachable while unprovisioned and requires no session of its own.

Raises: PortalError: 409 auth_state_corrupt if auth.json exists but cannot be read -- refused rather than treated as unset, so a crash-corrupted auth file can't reopen an already-owned device to anyone on the LAN; 503 identity_unavailable if the identity file could not be read at all -- a transient error (e.g. /boot/firmware not mounted yet) distinct from clean absence, refused rather than treated as "no identity file" so this unauthenticated flow can't open on a sticker/OEM device for as long as the read keeps failing; 409 initial_credentials_required if this device carries a manufacturing identity file -- it must go through POST /login with the sticker password and then POST /change-password instead, regardless of whether auth.json happens to be set; 409 auth_already_set if a password is already set.