Add one-time SSH hardening notice after forced password change

pikit-prep.sh

@@ -210,9 +210,13 @@ prep_image() {
   # --- Default login ---
   if id -u dietpi >/dev/null 2>&1; then
     echo "dietpi:pikit" | chpasswd && status CLEANED "reset dietpi password" || status FAIL "reset dietpi password"
+    mkdir -p /var/lib/pikit
+    rm -f /var/lib/pikit/first-login.notice
     case "${PIKIT_FORCE_PASSWORD_CHANGE,,}" in
       1|true|yes|on)
         chage -d 0 dietpi && status CLEANED "force dietpi password change on next login" || status FAIL "force dietpi password change"
+        :> /var/lib/pikit/first-login.notice && chmod 644 /var/lib/pikit/first-login.notice \
+          && status CLEANED "first-login notice armed" || status FAIL "first-login notice"
         ;;
       *) ;;
     esac