fix(app-shell): don't show the recovery-password reminder on a user's first landing (#2183)

The RecoveryPasswordReminder banner ("Set a recovery password so you can still
sign in if SSO is ever unavailable") fired on the env home whenever an SSO user
had no local password — including a brand-new user's very first screen, before
they've built anything. Premature: it loads the first-run magic moment with a
resilience nudge the user has no reason to care about yet. (The component's own
comment already intends "not before the first session"; the code didn't honor it.)

Gate on a first-visit marker: record the first home landing, show the reminder
only from the next visit onward. Still dismissible; still SSO-fallback resilience
for the default (password-allowed) envs.

Follow-up: the reminder also shows on SSO-enforced envs where password login is
disabled (recovery password unusable there) — that gate is separate.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/app-shell/src/console/home/HomePage.tsx

@@ -188,6 +188,15 @@ function RecoveryPasswordReminder({ t }: { t: (key: string, opts?: any) => strin
   const [show, setShow] = useState(false);
   useEffect(() => {
     if (typeof localStorage !== 'undefined' && localStorage.getItem('os:recovery-pw-dismissed') === '1') return;
+    // Don't nag on the very first landing: let a brand-new SSO user reach
+    // their magic moment (build their first app) before asking them to set a
+    // recovery password. Record the first home visit; show the reminder only
+    // from the next one on. (The component already intends 'not before the
+    // first session'; previously the code still fired on the very first screen.)
+    if (typeof localStorage !== 'undefined' && localStorage.getItem('os:recovery-pw-first-seen') !== '1') {
+      try { localStorage.setItem('os:recovery-pw-first-seen', '1'); } catch { /* ignore */ }
+      return;
+    }
     let cancelled = false;
     Promise.resolve(hasLocalPassword?.())
       .then((has) => { if (!cancelled && has === false) setShow(true); })