feat: FIRST_INSTALL_TOKEN to help services like Umbrel secure the first_install endpoint (#3751)

Co-authored-by: dni ⚡ <office@dnilabs.com>

lnbits/core/views/auth_api.py

@@ -503,6 +503,12 @@ async def update_ui_customization(
 async def first_install(data: UpdateSuperuserPassword) -> JSONResponse:
     if not settings.first_install:
         raise HTTPException(HTTPStatus.FORBIDDEN, "This is not your first install")
+    if settings.first_install_token:
+        if not data.first_install_token:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Missing first_install_token.")
+        if settings.first_install_token != data.first_install_token:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid first_install_token.")
+
     account = await get_account(settings.super_user)
     if not account:
         raise HTTPException(HTTPStatus.INTERNAL_SERVER_ERROR, "Superuser not found.")