Preserve colons in stored router passwords

[maghuro]

Summary

Preserve the complete router password when decoding stored Base64 credentials.

Problem

MerlinAU stores router credentials in the form:

username:password

and then Base64-encodes the complete string.

The WebUI currently decodes the value and retrieves the password using:

decoded.split(':')[1]

This only keeps the text between the first and second colon.

A valid password such as:

abc:def:ghi

is therefore restored as:

abc

If the settings are subsequently saved, the password may be silently replaced by the truncated value.

The shell-side credential editor also extracts the password by running a sed substitution using the current router username rather than parsing the stored credential delimiter directly.

Fix

The WebUI now locates the first colon and keeps everything after it.

The shell implementation uses shell parameter expansion to remove everything through the first colon.

Both therefore treat the first colon as the username/password separator and preserve any additional colons as part of the password.

Examples

Stored decoded credential:

admin:abcdefgh

Password:

abcdefgh

Stored decoded credential:

admin:abc:defgh

Password:

abc:defgh

Stored decoded credential:

miguel:abc:def:ghi

Password:

abc:def:ghi

Stored decoded credential:

root::leadingcolon

Password:

:leadingcolon

Stored decoded credential:

root:trailingcolon:

Password:

trailingcolon:

Validation

Both the WebUI and CLI password validators permit colon characters.

The existing credential writers already build the stored value as username followed by a single separator colon followed by the complete password.

The change therefore parses the existing storage format without changing that format.

Scope

This PR changes only credential decoding in MerlinAU.asp and MerlinAU.sh.

It does not change credential encoding, Base64 storage, password validation, login requests, or the configuration format.

[maghuro]

Superseded by a broader follow-up PR.

While validating this fix, I found that the stored router credential is also kept persistently in the WebUI-readable MerlinAU configuration. The replacement PR keeps the first-colon password parsing fix from this PR and adds protected server-side credential storage, so both related changes can be reviewed and merged together.

Closing this PR to avoid splitting the same credential-handling path across two dependent changes.