Use dedicated RADIUS credentials for Web Access Control SSH login

Switches authenticate SSH via RADIUS (aaa authentication login ssh
radius local), which is separate from the local admin account used
for the HTTPS GUI and baked into generated configs. Web Access
Control (HTTPS enable/disable and Disable Telnet) was reusing that
local admin credential (or per-switch NocoDB creds) for its SSH
connection, which is the wrong credential pair.

Adds a dedicated SSH Credentials (RADIUS) section in Settings and a
getSshCredentials() helper that Web Access Control uses exclusively,
plus an upfront error toast if those fields are left blank.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CLfUJoQTaUePx1m1d2v2j9

templates/index.html

@@ -741,6 +741,23 @@
           </div>
         </div>
 
+        <div style="margin-bottom:10px">
+          <div class="section-label" style="margin-bottom:6px">SSH Credentials (RADIUS)</div>
+          <div class="settings-grid">
+            <div class="setting-item full">
+              <span class="setting-label">SSH USERNAME</span>
+              <input type="text" id="s-ssh-username" value="">
+            </div>
+            <div class="setting-item full">
+              <span class="setting-label">SSH PASSWORD (plaintext)</span>
+              <input type="text" id="s-ssh-password" value="">
+            </div>
+          </div>
+          <div style="font-size:11px;color:var(--muted);margin-top:4px">
+            Used for the SSH login in Web Access Control (switches authenticate SSH via RADIUS, not the local admin account above).
+          </div>
+        </div>
+
         <div style="margin-bottom:10px">
           <div class="section-label" style="margin-bottom:6px">SNMP &amp; RADIUS</div>
           <div class="settings-grid">
@@ -928,6 +945,8 @@ function cfg() {
     gateway:      document.getElementById('s-gateway').value.trim(),
     defaultUsername: document.getElementById('s-username').value.trim(),
     defaultPassword: document.getElementById('s-password').value.trim(),
+    sshUsername: document.getElementById('s-ssh-username').value.trim(),
+    sshPassword: document.getElementById('s-ssh-password').value.trim(),
     engineId:     document.getElementById('s-engine-id').value.trim(),
     radius:       document.getElementById('s-radius').value.trim(),
     snmpSwitchmonAuth: document.getElementById('s-snmp-switchmon-auth').value.trim(),
@@ -1285,11 +1304,15 @@ function getWaTargetSwitches() {
   return switches; // all
 }
 
-function getCredentials(sw) {
+// SSH login to the switches goes through RADIUS, not the local admin
+// account used for the HTTPS GUI / baked into generated configs — so
+// Web Access Control uses its own credential fields, not per-switch
+// NocoDB creds or the DEFAULT USERNAME/PASSWORD settings.
+function getSshCredentials() {
   const c = cfg();
   return {
-    username: (sw.Username || '').trim() || c.defaultUsername || 'admin',
+    username: c.sshUsername,
-    password: (sw.Password || '').trim() || c.defaultPassword || '',
+    password: c.sshPassword,
   };
 }
 
@@ -1324,7 +1347,7 @@ async function runWithConcurrency(tasks, concurrency, onStart, onDone) {
 }
 
 async function sendWebAccess(sw, action) {
-  const creds = getCredentials(sw);
+  const creds = getSshCredentials();
   const res = await fetch('/api/web-access', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -1371,6 +1394,12 @@ async function runWaOperation(action) {
     return;
   }
 
+  const sshCreds = getSshCredentials();
+  if (!sshCreds.username || !sshCreds.password) {
+    showToast('Set SSH USERNAME / SSH PASSWORD (RADIUS) in Settings first', 'err');
+    return;
+  }
+
   btnWaEnable.disabled  = true;
   btnWaDisable.disabled = true;
   btnWaDisableTelnet.disabled = true;