Split "disable local login" from the initial SSO setup step

Confirmed live: offering DISABLE_PASSWORD_AUTH/ALLOW_PASSWORD_LOGIN in the
same breath as printing the Authelia paste-in values lets an admin say yes
before actually pasting those values into the app's own settings and
testing the button — leaving neither login path working (password form
gone, OAuth provider never actually finished on the app's side).

Both are now their own function, only reachable on a later run (Beszel:
independently after the SSO offer; Mealie: from the "already configured,
not reconfiguring" branch), and gated behind an explicit "have you already
logged in successfully via the Authelia button?" confirmation before the
disable prompt is even offered.

services/beszel.sh

@@ -299,30 +299,54 @@ _beszel_offer_authelia_oidc() {
 
     declare -F _authelia_scope_access >/dev/null 2>&1 && _authelia_scope_access "beszel" "$APP_DOMAIN"
 
-    # DISABLE_PASSWORD_AUTH/USER_CREATION are real, documented env vars
-    # (beszel.dev's own OAuth guide) — but Beszel has no default account:
-    # the FIRST person to register becomes admin (see this file's own
-    # README section), and there's no signup-fallback like Mealie's
-    # OIDC_SIGNUP_ENABLED convenience wording to lean on if that hasn't
-    # happened yet. Off by default and gated behind an explicit warning —
-    # flipping this before a working login exists risks locking the hub's
-    # UI out with no account able to reach it at all.
     echo ""
-    local _disable_local=""
-    prompt_yn "  Also disable Beszel's own password login, so Authelia is the only way in? Only do this AFTER you've registered a working account. (y/n):" "n" _disable_local
-    if [[ "$_disable_local" =~ ^[Yy]$ ]]; then
-        local _auto_register=""
-        prompt_yn "  Auto-create Beszel accounts for new Authelia logins? (y/n):" "n" _auto_register
-        sed -i '/^DISABLE_PASSWORD_AUTH=/d; /^USER_CREATION=/d' "$dir/.env"
-        {
-            echo "DISABLE_PASSWORD_AUTH=true"
-            [[ "$_auto_register" =~ ^[Yy]$ ]] && echo "USER_CREATION=true"
-        } >> "$dir/.env"
-        chown "$ACTUAL_USER:$ACTUAL_USER" "$dir/.env" 2>/dev/null || true
-        ( cd "$dir" && docker compose up -d beszel ) \
-            && log_success "Beszel's own password login is now disabled — Authelia is the only way in." \
-            || log_warning "Restart failed — check: docker compose -f $dir/docker-compose.yml logs beszel"
+    log_info "Paste those values into Beszel's Settings -> Auth providers -> OpenID"
+    log_info "Connect page now, then log out and click through the Authelia login"
+    log_info "button to confirm it actually works — BEFORE going any further here."
+    echo ""
+    log_warning "The next step can disable Beszel's password login entirely. Confirmed"
+    log_warning "live: saying yes here before actually testing the button leaves NEITHER"
+    log_warning "login path working — the password form is gone, and the OAuth provider"
+    log_warning "was never actually finished on Beszel's side, so its button never"
+    log_warning "appears either. Re-run 'sudo ./setup.sh beszel' (choose update) any time"
+    log_warning "later to come back to this once you've verified the button works."
+}
+
+# Split out from _beszel_offer_authelia_oidc so it can also be re-reached on
+# its own via a later "update" rerun, once the admin has actually gone and
+# tested the Authelia login button — see that function's own warning for
+# why this can't be offered in the same breath as printing the paste-in
+# values. DISABLE_PASSWORD_AUTH/USER_CREATION are real, documented env vars
+# (beszel.dev's own OAuth guide).
+_beszel_offer_disable_password_auth() {
+    local dir="$1"
+    [ -f "$dir/.env" ] || return 0
+    grep -qF "client_id: 'beszel'" "$DOCKER_DIR/authelia/config/configuration.yml" 2>/dev/null || return 0
+    grep -q '^DISABLE_PASSWORD_AUTH=true' "$dir/.env" 2>/dev/null && return 0
+
+    echo ""
+    local _tested=""
+    prompt_yn "  Have you ALREADY logged into Beszel successfully using the Authelia button (not just pasted the values)? (y/n):" "n" _tested
+    if [[ ! "$_tested" =~ ^[Yy]$ ]]; then
+        log_info "Skipped. Test the Authelia login button first, then re-run 'sudo ./setup.sh beszel' (choose update) to come back to this."
+        return 0
     fi
+
+    local _disable_local=""
+    prompt_yn "  Disable Beszel's own password login now, so Authelia is the only way in? (y/n):" "n" _disable_local
+    [[ "$_disable_local" =~ ^[Yy]$ ]] || return 0
+
+    local _auto_register=""
+    prompt_yn "  Auto-create Beszel accounts for new Authelia logins? (y/n):" "n" _auto_register
+    sed -i '/^DISABLE_PASSWORD_AUTH=/d; /^USER_CREATION=/d' "$dir/.env"
+    {
+        echo "DISABLE_PASSWORD_AUTH=true"
+        [[ "$_auto_register" =~ ^[Yy]$ ]] && echo "USER_CREATION=true"
+    } >> "$dir/.env"
+    chown "$ACTUAL_USER:$ACTUAL_USER" "$dir/.env" 2>/dev/null || true
+    ( cd "$dir" && docker compose up -d beszel ) \
+        && log_success "Beszel's own password login is now disabled — Authelia is the only way in." \
+        || log_warning "Restart failed — check: docker compose -f $dir/docker-compose.yml logs beszel"
 }
 
 install_beszel() {
@@ -361,6 +385,7 @@ install_beszel() {
                     [[ "$FINISH_AGENT" =~ ^[Yy]$ ]] && _beszel_configure_agent "$DIR" "http://localhost:${_WP}  (or its Caddy domain, once configured)"
                 fi
                 _beszel_offer_authelia_oidc "$DIR"
+                _beszel_offer_disable_password_auth "$DIR"
                 return 0
                 ;;
             cancel)