Previously the web terminal always opened with a 'Username:' / 'Password:'
prompt (or, when embedded in an iframe without a URL-supplied user, waited
silently for credentials via postMessage). For embedding scenarios where
the default user has an empty password, this is unnecessary friction.

Now the web terminal performs an initial connection attempt using the
URL-supplied user (or 'default') with an empty password. If the server
rejects it, the existing fallback runs: interactive prompt, or postMessage
when embedded without a URL user.

`play.html` posts `webterminal-credentials` exactly once on iframe
`load`. With auto-auth running on startup, that message could arrive
while `waitingForCredentials` was still `false` and be silently
dropped; the subsequent `ws.onclose` flipped the flag to `true`, but
no second message ever came, leaving the embedded terminal stuck.

Pre-arm `waitingForCredentials` before the initial auto-auth attempt
when embedded without a URL-supplied user, so a one-shot parent
message is consumed regardless of timing (the in-flight connection
is replaced). Also clear `initialAutoAuth` when parent credentials
arrive, so a subsequent failure prompts interactively instead of
waiting for another (non-existent) parent message.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>