Issue #183 Part B: show node secured/unsecured state so operators can
tell the difference between a broken node and one waiting for first-boot
password setup.
daemon: add "secured": bool to status response
(true iff ${data_dir}/.secured exists)
TUI: fetch secured from daemon status each refresh cycle
render [UNSECURED — set root password to activate agent]
in red bold when node is unsecured
Part A (rc.d gate gating autospawn on .secured) was already complete.
