docs(wifi): the setup AP is open; auto-enable can be turned off without code changes

- WIFI_NETWORK_SETUP / SSH_UNAVAILABLE_AFTER_INSTALL: both AP paths in
  src/wifi_manager.py create an open network and nothing reads
  ap_password, so drop the "ledmatrix123" password and the ap_password
  key/advice.
- SSH_UNAVAILABLE_AFTER_INSTALL: disabling automatic AP mode does not
  need code changes -- auto_enable_ap_mode is a WiFi-tab toggle and
  POST /api/v3/wifi/ap/auto-enable; note the monitor daemon reads
  wifi_config.json at start, so restart it after changing the setting.
  Use the ledpi username and a relative install path like the other docs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/SSH_UNAVAILABLE_AFTER_INSTALL.md

@@ -8,7 +8,7 @@ After running `first_time_install.sh`, SSH may become unavailable for the follow
 
 **Primary Cause**: The WiFi monitor service (`ledmatrix-wifi-monitor`) automatically enables Access Point (AP) mode when it detects that the Raspberry Pi is not connected to WiFi. When AP mode is active:
 
-- The Pi creates its own WiFi network: **LEDMatrix-Setup** (password: `ledmatrix123`)
+- The Pi creates its own WiFi network: **LEDMatrix-Setup** (open, no password)
 - The Pi's WiFi interface (`wlan0`) switches from client mode to AP mode
 - **This disconnects the Pi from your original WiFi network**
 - SSH becomes unavailable because the Pi is no longer on your network
@@ -45,7 +45,7 @@ If the script reboots the Pi (which it recommends), network services may restart
 
 1. **Find the AP Network**:
    - Look for a WiFi network named **LEDMatrix-Setup** on your phone/computer
-   - Default password: `ledmatrix123`
+   - It is an open network: no password
 
 2. **Connect to the AP**:
    - Connect your device to the **LEDMatrix-Setup** network
@@ -53,7 +53,7 @@ If the script reboots the Pi (which it recommends), network services may restart
 
 3. **SSH via AP Mode**:
    ```bash
-   ssh devpi@192.168.4.1
+   ssh ledpi@192.168.4.1
    ```
 
 4. **Disable AP Mode and Reconnect to WiFi**:
@@ -96,7 +96,7 @@ sudo nmcli device wifi connect "YourWiFiSSID" password "YourPassword"
 
 If your Pi is connected via Ethernet:
 - SSH should remain available via Ethernet even if WiFi is in AP mode
-- Connect via: `ssh devpi@<pi-ip-address>`
+- Connect via: `ssh ledpi@<pi-ip-address>`
 
 ### Option 4: Physical Access
 
@@ -134,14 +134,22 @@ sudo systemctl disable ledmatrix-wifi-monitor
 
 ### Method 3: Configure WiFi Monitor to Not Auto-Enable AP
 
-Edit the WiFi monitor configuration to prevent automatic AP mode:
+Turn off `auto_enable_ap_mode` so the monitor never starts AP mode on its
+own (you can still enable AP mode by hand). Either switch off
+**Auto-Enable AP Mode** in the web interface's **WiFi** tab, or use the API:
 
 ```bash
-# Edit the WiFi config (if it exists)
+curl -X POST http://<pi-ip-address>:5000/api/v3/wifi/ap/auto-enable \
-nano /home/devpi/LEDMatrix/config/wifi_config.json
+  -H "Content-Type: application/json" \
+  -d '{"auto_enable_ap_mode": false}'
+```
 
-# Or modify the WiFi monitor daemon behavior
+Or set `"auto_enable_ap_mode": false` in `config/wifi_config.json` by hand.
-# (requires code changes to wifi_monitor_daemon.py)
+The monitor daemon reads `wifi_config.json` when it starts, so whichever way
+you change the setting, restart it afterwards:
+
+```bash
+sudo systemctl restart ledmatrix-wifi-monitor
 ```
 
 ## Verification Steps
@@ -149,7 +157,7 @@ nano /home/devpi/LEDMatrix/config/wifi_config.json
 After regaining SSH access, verify your installation:
 
 ```bash
-cd /home/devpi/LEDMatrix
+cd ~/LEDMatrix   # wherever you installed LEDMatrix
 ./scripts/verify_installation.sh
 ```
 
@@ -225,7 +233,7 @@ different responses:
 - Prevention and tuning: [LOW_MEMORY_BOARDS.md](LOW_MEMORY_BOARDS.md)
 
 **To regain SSH**:
-1. Connect to **LEDMatrix-Setup** AP network (password: `ledmatrix123`)
+1. Connect to **LEDMatrix-Setup** AP network (open, no password)
 2. SSH to `192.168.4.1`
 3. Disable AP mode and reconnect to your WiFi network
 4. Or disable the WiFi monitor service if not needed

docs/WIFI_NETWORK_SETUP.md

@@ -21,9 +21,8 @@ The LEDMatrix WiFi system provides automatic network configuration with intellig
 
 **If not connected to WiFi:**
 1. Wait 90 seconds after boot (AP mode activation grace period)
-2. Connect to WiFi network **LEDMatrix-Setup** (default password
+2. Connect to WiFi network **LEDMatrix-Setup** (an open network: no
-   `ledmatrix123` — change it in `config/wifi_config.json` if you want
+   password)
-   an open network or a different password)
 3. Open browser to: `http://192.168.4.1:5000`
 4. Open the **WiFi** tab
 5. Scan, select your network, and connect
@@ -78,7 +77,6 @@ WiFi settings are stored in `config/wifi_config.json`:
 ```json
 {
   "ap_ssid": "LEDMatrix-Setup",
-  "ap_password": "ledmatrix123",
   "ap_channel": 7,
   "auto_enable_ap_mode": true,
   "saved_networks": [
@@ -96,7 +94,6 @@ WiFi settings are stored in `config/wifi_config.json`:
 | Setting | Default | Description |
 |---------|---------|-------------|
 | `ap_ssid` | `LEDMatrix-Setup` | Network name broadcast in AP mode |
-| `ap_password` | `ledmatrix123` | AP password. Set to `""` to make the network open (no password). |
 | `ap_channel` | `7` | WiFi channel (1, 6, or 11 are non-overlapping) |
 | `auto_enable_ap_mode` | `true` | Automatically enable AP mode when both WiFi and Ethernet are disconnected |
 | `saved_networks` | `[]` | Array of saved WiFi credentials |
@@ -214,8 +211,10 @@ The system checks connections in this order:
 ### AP Mode Settings
 
 - **SSID**: `LEDMatrix-Setup` (configurable via `ap_ssid`)
-- **Network**: WPA2, default password `ledmatrix123` (configurable via
+- **Network**: open (no password). Both AP paths create an open network
-  `ap_password` — set to `""` for an open network)
+  (`_create_hostapd_config()` and `_enable_ap_mode_nmcli_hotspot()` in
+  `src/wifi_manager.py`); an `ap_password` key in `wifi_config.json` is not
+  read
 - **IP Address**: 192.168.4.1
 - **DHCP Range**: 192.168.4.2 – 192.168.4.20
 - **Channel**: 7 (configurable via `ap_channel`)
@@ -233,16 +232,12 @@ When AP mode is active:
 
 ### Security Recommendations
 
-**1. Change AP Password (Optional):**
+**1. Keep AP mode short-lived:**
-```json
+The setup network is open, so anyone nearby can join it and reach the web
-{
+interface while it is up. AP mode only comes up when WiFi and Ethernet are
-  "ap_password": "your-strong-password"
+both disconnected (after the 90 second grace period) and goes down again once
-}
+the Pi is connected; in a public area, consider setting
-```
+`auto_enable_ap_mode` to `false` and enabling AP mode by hand when needed.
-
-**Note:** The default password is `ledmatrix123` for easy initial
-setup. Change it for any deployment in a public area, or set
-`ap_password` to `""` if you specifically want an open network.
 
 **2. Use Non-Overlapping WiFi Channels:**
 - Channels 1, 6, 11 are non-overlapping (2.4GHz)