Keep credential replacement required for legacy session responses

docs/architecture.md

@@ -17,6 +17,9 @@ HTTP 401/403 clears the saved session and requests login. Server failures retain
 the credential and retry immediately, then after 3, 10, 15, and repeatedly 30
 seconds. Manual login and logout cancel pending restoration. Dashboard-loading
 failures do not invalidate a successfully verified session.
+Restored sessions retain the server's mandatory credential-replacement state.
+An omitted replacement flag is treated conservatively as requiring setup rather
+than silently allowing the dashboard to consider setup complete.
 
 Run `node --test src/session-recovery.test.js` for response classification and
 retry-schedule coverage. This is not a substitute for native AppImage acceptance.

src/App.svelte

@@ -100,7 +100,7 @@
       authError = '';
       sessionToken = storedSession;
       authenticated = true;
-      mustReplaceCredentials = result.must_replace_credentials;
+      mustReplaceCredentials = result.must_replace_credentials !== false;
       connectionState = 'CONNECTED';
       await loadAuthenticatedData().catch(() => {
         authError = 'Authenticated, but dashboard data could not be loaded.';