basement: declare 4 required env vars + auto-generate JWT secret

basement-ui as of latest now requires BASEMENT_DRIVER /
BASEMENT_ADMIN_USER / BASEMENT_ADMIN_PASSWORD_HASH / BASEMENT_JWT_SECRET
and refuses to start without them — container was crash-looping.

Template now declares all four:
  - DRIVER: defaults to "garage" (this deployment's storage backend).
  - JWT_SECRET: install.sh generates a hex string into secrets.env
    next to the garage secrets, sed-substitutes into the template.
    Backfills existing secrets.env that predates this key.
  - ADMIN_USER / ADMIN_PASSWORD_HASH: left blank; user fills via
    Unraid UI. bcrypt hash recipe is in both the file header and the
    PASSWORD_HASH config description.

unraid-1/install.sh

@@ -57,15 +57,26 @@ else
   GARAGE_RPC_SECRET=$(openssl rand -hex 32)
   GARAGE_ADMIN_TOKEN=$(openssl rand -hex 32)
   GARAGE_METRICS_TOKEN=$(openssl rand -hex 32)
+  BASEMENT_JWT_SECRET=$(openssl rand -hex 32)
   umask 077
   cat > "$SECRETS" <<EOF
 GARAGE_RPC_SECRET=$GARAGE_RPC_SECRET
 GARAGE_ADMIN_TOKEN=$GARAGE_ADMIN_TOKEN
 GARAGE_METRICS_TOKEN=$GARAGE_METRICS_TOKEN
+BASEMENT_JWT_SECRET=$BASEMENT_JWT_SECRET
 EOF
   say "generated secrets → $SECRETS"
 fi
 
+# Existing deployments predate BASEMENT_JWT_SECRET; backfill if missing
+# so the basement template sub'n doesn't leave a literal placeholder.
+if [ -z "${BASEMENT_JWT_SECRET:-}" ]; then
+  BASEMENT_JWT_SECRET=$(openssl rand -hex 32)
+  umask 077
+  printf "BASEMENT_JWT_SECRET=%s\n" "$BASEMENT_JWT_SECRET" >> "$SECRETS"
+  say "backfilled BASEMENT_JWT_SECRET into $SECRETS"
+fi
+
 # ── Templates ──
 # Fetch each, optionally sed-substitute __PLACEHOLDER__ secrets, write to
 # templates-user/. Secrets are hex chars only — safe in sed delimiters.
@@ -94,7 +105,8 @@ fetch_template \
 fetch_template \
   "$BASE/basement.template.xml" \
   "$TEMPLATE_DIR/my-basement.xml" \
-  -e "s|__GARAGE_ADMIN_TOKEN__|$GARAGE_ADMIN_TOKEN|"
+  -e "s|__GARAGE_ADMIN_TOKEN__|$GARAGE_ADMIN_TOKEN|" \
+  -e "s|__BASEMENT_JWT_SECRET__|$BASEMENT_JWT_SECRET|"
 
 fetch_template \
   "$BASE/watchtower.template.xml" \