fix: login password hint + Windows CLI healthcheck + i18n key

- fix(ux): add default password hint on login page for first-time users (#437)
  The fallback password (123456) is now shown as a hint below the
  password input so users don't get locked out during initial setup.

- fix(cli): add shell:true to spawn on Windows so .cmd wrappers are
  resolved correctly via PATHEXT (#447). Claude, opencode, and other
  npm-installed CLIs show as 'not runnable' on Windows even when
  installed because spawn() cannot find .cmd files without shell:true.

- i18n: add defaultPasswordHint key to en.json auth namespace

src/app/login/page.tsx

@@ -203,6 +203,7 @@ export default function LoginPage() {
                   {error}
                 </p>
               )}
+              <p className="text-xs text-text-muted/60 pt-0.5">{t("defaultPasswordHint")}</p>
             </div>
 
             <Button

src/i18n/messages/en.json

@@ -2293,7 +2293,8 @@
     "orRemovePasswordHashField": "or remove the passwordHash field",
     "restartServerWithNewPassword": "Restart the server - it will use the new password",
     "backToLogin": "Back to Login",
-    "forgotPassword": "Forgot password?"
+    "forgotPassword": "Forgot password?",
+    "defaultPasswordHint": "Default password: 123456 (unless INITIAL_PASSWORD was set)"
   },
   "landing": {
     "brandName": "OmniRoute",

src/shared/services/cliRuntime.ts

@@ -121,7 +121,14 @@ const runProcess = (
     let timedOut = false;
     let settled = false;
 
-    const child = spawn(command, args, { env, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn(command, args, {
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+      // On Windows, npm installs CLI wrappers as .cmd scripts (e.g. claude.cmd).
+      // Without shell:true, spawn cannot resolve them via PATHEXT and the
+      // healthcheck fails even when the CLI is correctly installed (#447).
+      ...(isWindows() ? { shell: true } : {}),
+    });
     const timer = setTimeout(() => {
       timedOut = true;
       child.kill("SIGKILL");