Change to a non-root account with ssh key

docs/TODO.md

@@ -56,6 +56,14 @@ and cleanup.
   report-only.
 - Note: orthogonal to the `rd.dot1x=0` test toggle, but a full STIG production
   posture wants 802.1X re-enabled.
+- **Credentials (partly done):** root is now **locked** and access is via a
+  baked sudo-enabled key-only admin user (`var.ssh_authorized_key` /
+  `var.admin_user`, `wheel` + NOPASSWD sudo), with sshd drop-in
+  `PermitRootLogin no` / `PasswordAuthentication no`. Two items for STIG to
+  reconcile: **NOPASSWD sudo** is a finding (acceptable for a key-only account,
+  but document/deviate), and the admin key/user are **fleet-wide baked** — for
+  per-host/rotatable access without rebuilds, layer the signed HTTP/SMBIOS
+  config-agent or an SSH CA (`TrustedUserCAKeys`) discussed in session.
 
 ## [ ] 3. Roll the errata into design doc v3