firstboot: Update wizard with SSH key and experimental disclaimer

- Add welcome screen with experimental build disclaimer
- Add SSH public key input field to baremetal wizard
- Export SSH_PUBLIC_KEY to environment
- Call clawdie_shell_ssh_setup in module sequence (after pkg, before env)

Wizard now collects: name, domain, timezone, SSH key
Users can optionally provide SSH key to enable passwordless auth.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

firstboot/firstboot.sh

@@ -19,6 +19,7 @@ log_msg() { echo "$(date '+%H:%M:%S') $1" | tee -a "$LOG_FILE"; }
 . "${SHARE}/firstboot/shell-gpu.sh"
 . "${SHARE}/firstboot/shell-nvidia.sh"
 . "${SHARE}/firstboot/shell-pkg.sh"
+. "${SHARE}/firstboot/shell-ssh.sh"
 . "${SHARE}/firstboot/shell-env.sh"
 . "${SHARE}/firstboot/shell-system.sh"
 . "${SHARE}/firstboot/shell-deploy.sh"
@@ -37,12 +38,16 @@ else
     # API keys are NOT collected here — deferred to web UI on first desktop login
     _dialog() { bsddialog --backtitle "Clawdie-AI Setup" "$@" 2>&1; }
 
+    # Welcome + risk disclaimer
+    _dialog --msgbox "\n⚠ EXPERIMENTAL BUILD\n\nThis is pre-release software.\nNot recommended for production use.\nData loss or service interruption possible.\n\nBy continuing, you assume all risks." 12 60
+
     ASSISTANT_NAME=$(_dialog --inputbox "Assistant name:" 8 50 "Clawdie")
     AGENT_DOMAIN=$(_dialog --inputbox "Agent domain (e.g. clawdie.local):" 8 50 "clawdie.local")
     TZ=$(_dialog --inputbox "Timezone (e.g. Europe/Ljubljana):" 8 50 "UTC")
+    SSH_PUBLIC_KEY=$(_dialog --inputbox "SSH public key (optional but recommended):\n(paste ssh-ed25519 or ssh-rsa key):" 12 70 "")
 fi
 
-export ASSISTANT_NAME AGENT_DOMAIN TZ
+export ASSISTANT_NAME AGENT_DOMAIN TZ SSH_PUBLIC_KEY
 
 # ── Run modules ────────────────────────────────────────────────────────────
 log_msg "[firstboot] Running modules..."
@@ -50,6 +55,7 @@ log_msg "[firstboot] Running modules..."
 clawdie_shell_gpu_detect      # GPU driver → rc.conf kld_list (cloud: skips)
 clawdie_shell_nvidia_detect   # NVIDIA version selection (cloud + non-NVIDIA: skips)
 clawdie_shell_pkg_setup       # Configure pkg repos, seed offline cache
+clawdie_shell_ssh_setup       # SSH keys and system user passwords
 clawdie_shell_env_generate    # Generate .env with secrets (API keys left blank)
 clawdie_shell_system_config   # hostname, rc.conf services, profile.d
 clawdie_shell_deploy          # Extract tarball, npm install, provision jails