fix(frontend): add autocomplete attrs to credential inputs

Silences browser accessibility warnings on the HA token, MQTT username,
and MQTT password fields. Uses new-password for the secret inputs to
discourage Chrome's site-password autofill from leaking into broker /
HA-token configuration.

TODO.md

@@ -66,17 +66,6 @@ Drive USB LED controllers (APA102, WS2812) connected directly to the Android TV
 - [ ] Test with common USB-to-serial chips: CH340, CP2102, FTDI
 - [ ] Document supported USB LED controllers in README
 
-## Android App — Known Issues
-
-Issues discovered during first end-to-end test on emulator (2026-04-14):
-
-- [ ] **Stop/Start capture produces no frames on second try.** First capture works, but after tapping Stop and Start again, no frames reach the Python pipeline. Likely causes:
-  - Global MediaProjection engine state (`_active`, `_frame_queue`) not reset on service restart
-  - ScreenCapture listener not properly detached from ImageReader on stop
-  - Python uvicorn port reuse issue when server restarts
-- [ ] **Web UI tabs show persistent spinners** on Dashboard, Automation, Sources, Integrations, Graph tabs (Targets tab works). All API calls return 200 OK, no console errors. Probably waiting on a specific WebSocket event that never fires when no output targets are configured/active.
-- [ ] **Dead keyboard/IME handling** — password inputs lack autocomplete attributes (minor accessibility warning in browser console)
-
 ## Performance Metrics Abstraction
 
 The codebase has direct `psutil.*` calls scattered across `api/routes/system.py` and `core/processing/metrics_history.py`, with ad-hoc `if psutil is not None` guards sprinkled in to support Android. This couples Android platform handling to every call site.