Add optional console password (chpasswd) to cloud-init and deploy docs

deploy/README.md

@@ -63,6 +63,32 @@ openstack server create \
 
 The VM boots with Docker installed, firewall configured (or skipped on OpenStack), and your SSH key authorized. Log in as the `devbox` user.
 
+### Console password (optional)
+
+The cloud-init template uses SSH key authentication only — no password is set by default. This is sufficient for normal use since the `devbox` user has passwordless `sudo`.
+
+A password is only needed for:
+
+- **Emergency console access** — logging in via OpenStack Horizon console (noVNC) or Proxmox VNC when SSH is unreachable
+- **`su - devbox`** — switching to the devbox user from another account
+
+To enable console access, uncomment the `chpasswd` block in `cloud-init.yml` before deploying:
+
+```yaml
+chpasswd:
+  expire: false
+  users:
+    - name: devbox
+      password: your-password-here
+      type: text
+```
+
+For an already-running VM, set a password via SSH:
+
+```bash
+sudo passwd devbox
+```
+
 ### Option 2: Post-install script (manual)
 
 On a fresh Debian/Ubuntu VM:

deploy/cloud-init.yml

@@ -23,6 +23,18 @@ users:
       # CUSTOMIZE: replace with your public SSH key
       - ssh-ed25519 AAAA... your-key-here
 
+# ── Optional: console password ───────────────────────────────────────
+# Uncomment to set a password for the devbox user. Only needed for
+# emergency access via the OpenStack/Proxmox console (VNC/noVNC).
+# SSH key authentication is used for normal access.
+#
+# chpasswd:
+#   expire: false
+#   users:
+#     - name: devbox
+#       password: your-password-here
+#       type: text
+
 # ── Locale and timezone ──────────────────────────────────────────────
 locale: en_US.UTF-8
 timezone: Europe/Stockholm