pub const ENSURE_API_TOKEN_SCRIPT: &str = r#"
set -e
sudo mkdir -p /etc/horto-os-ui
if [ ! -f /etc/horto-os-ui/api.env ]; then
TOKEN=$(openssl rand -hex 32 2>/dev/null || head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')
printf 'HORTO_API_TOKEN=%s\n' "$TOKEN" | sudo tee /etc/horto-os-ui/api.env >/dev/null
sudo chmod 600 /etc/horto-os-ui/api.env
fi
DROP="${HOME}/.horto-os-ui-api-token"
sudo grep '^HORTO_API_TOKEN=' /etc/horto-os-ui/api.env > "$DROP"
chmod 600 "$DROP"
"#;Expand description
Ensure /etc/horto-os-ui/api.env exists with a random bearer token (0600).
Reuses an existing file so reinstall does not rotate the token. Writes the
hex into $HOME/.horto-os-ui-api-token (0600) for PC-side Capture (no TTY echo).