The configure-sunshine recipe step (added in v1.9.13) tries to set Sunshine credentials using sunshine.exe --creds, but this fails silently because:

1. Sunshine's default credentials are admin/admin, not empty. The --creds CLI flag assumes no existing credentials.
2. Sunshine requires initial setup via its web API (POST /api/password) before the pairing API works. Until credentials are set, all API calls redirect to /welcome.

Impact: After provisioning a new node with hydraguard-air, Sunshine is reachable via WireGuard but streaming fails with: pairing: submitting PIN to Sunshine: PIN submission failed (HTTP 400)

Proposed fix: Replace the CLI-based approach with Sunshine's /api/password endpoint, using admin/admin as the current credentials:
curl -sk -X POST -H 'Content-Type: application/json' -d '{"currentUsername":"admin","currentPassword":"admin","newUsername":"sunshine","newPassword":"sunshine","confirmNewPassword":"sunshine"}' https://localhost:47990/api/password

Workaround: Manually set credentials via the Sunshine API from a machine on the WireGuard network (already done for sneaky-squid-86).

Related: hydracluster v1.9.13 (added recipe step), v1.9.14 (CIDR fix)