Web UI default port 8888; Lock now in the power menu

New installs put the Web UI on port 8888 instead of 8090 (existing installs
keep their port; change it under Addons -> Web UI, which now also closes the
old port in the firewall). The power menu gets a Lock now button, shown only
when password protection is on.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wi3ZQveYdjfcrEsyazq32

kiosk-app/main.js

@@ -1226,6 +1226,19 @@ function historyHome(){
   markActivity();
 }
 
+// Power menu -> Lock now: put up the lock screen right away (the same one
+// the inactivity timeout shows). Only when password protection is on and a
+// code is set - showLockoutScreen refuses otherwise, so a kiosk with no
+// code can't be locked with nothing to unlock it.
+function lockNow(){
+  if(!enablePasswordProtection||!lockoutPassword){
+    console.log('[LOCKOUT] Lock now ignored - password protection is off');
+    return;
+  }
+  console.log('[LOCKOUT] Lock now requested from the power menu');
+  showLockoutScreen('unlock');
+}
+
 function showPinEntry(){
   if(pinWindow&&!pinWindow.isDestroyed()){
     pinWindow.focus();
@@ -1545,7 +1558,7 @@ function showPowerMenu(){
 
   // For normal mode, use custom overlay with 30-second timeout
   console.log('[POWER] Showing custom power menu overlay');
-  const powerInfo={version:VERSION,localIP:localIP,vpnIP:vpnIP.trim()};
+  const powerInfo={version:VERSION,localIP:localIP,vpnIP:vpnIP.trim(),canLock:!!(enablePasswordProtection&&lockoutPassword)};
   // Send to all views (preload.js runs in views, not mainWindow)
   for(const view of views){
     if(view&&view.webContents&&!view.webContents.isDestroyed()){
@@ -1730,6 +1743,7 @@ async function createWindow(){
     if(action==='shutdown')exec('systemctl poweroff');
     else if(action==='restart')exec('systemctl reboot');
     else if(action==='reload'){app.relaunch();app.quit();}
+    else if(action==='lock')lockNow();
   });
   ipcMain.on('toggle-hidden',toggleHidden);
   ipcMain.on('history-nav',(event,direction)=>{

kiosk-app/preload.js

@@ -666,6 +666,16 @@ window.addEventListener('DOMContentLoaded',()=>{
       ipcRenderer.send('power-action','reload');
     });
 
+    // Only offered when password protection is on (set in showPowerMenu).
+    const lockBtn=document.createElement('button');
+    lockBtn.id='power-menu-lock';
+    lockBtn.textContent='🔒 Lock now';
+    lockBtn.style.cssText=btnStyle+'background:#8e44ad;color:white;display:none;';
+    lockBtn.addEventListener('click',()=>{
+      hidePowerMenu();
+      ipcRenderer.send('power-action','lock');
+    });
+
     const cancelBtn=document.createElement('button');
     cancelBtn.textContent='Cancel';
     cancelBtn.style.cssText=btnStyle+'background:#7f8c8d;color:white;';
@@ -673,6 +683,7 @@ window.addEventListener('DOMContentLoaded',()=>{
       hidePowerMenu();
     });
 
+    buttonsDiv.appendChild(lockBtn);
     buttonsDiv.appendChild(shutdownBtn);
     buttonsDiv.appendChild(restartBtn);
     buttonsDiv.appendChild(reloadBtn);
@@ -708,6 +719,8 @@ window.addEventListener('DOMContentLoaded',()=>{
         }
         infoDiv.innerHTML=infoText;
       }
+      const lockBtn=document.getElementById('power-menu-lock');
+      if(lockBtn)lockBtn.style.display=(info&&info.canLock)?'':'none';
 
       powerMenu.style.display='flex';
       powerMenuVisible=true;