fix: admpass.sh hang, OLS httpd_config structure, listener maps

Three fixes:

1. Replace admpass.sh calls with direct htpasswd writes — the script
   is interactive-only (no --password flag) and hangs forever in
   automation. Write admin htpasswd directly with openssl passwd.

2. Fix httpd_config.conf template — OLS requires virtualHost {} blocks
   with vhRoot/configFile, not bare include of vhconf.conf files.
   Add proper _backend virtualHost block, map it to Backend listener,
   use self-signed cert for Secure listener until real certs exist.

3. Fix addOLSListenerMap to only add maps to Default and Secure
   listeners (not Backend which is reserved for the admin panel).

4. Fix default PHP detection to read from wo.conf config instead
   of picking first installed version (which would prefer php74).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

wo/cli/plugins/stack_pref.py

@@ -109,13 +109,24 @@ def post_pref(self, apt_packages, packages, upgrade=False):
             if not os.path.exists(ols_vhost):
                 os.makedirs(ols_vhost)
 
-            # Determine default PHP version
-            default_php_short = '84'
-            for ver_key, ver_num in WOVar.wo_php_versions.items():
-                short = ver_num.replace('.', '')
-                if os.path.exists('/usr/local/lsws/lsphp{0}/bin/lsphp'.format(short)):
-                    default_php_short = short
-                    break
+            # Determine default PHP version from config
+            try:
+                config_php = self.app.config.get('php', 'version')
+                default_php_short = config_php.replace('.', '')
+            except Exception:
+                default_php_short = '85'
+            # Fallback: if configured LSPHP binary doesn't exist, find one
+            if not os.path.exists(
+                    '/usr/local/lsws/lsphp{0}/bin/lsphp'
+                    .format(default_php_short)):
+                for ver_num in reversed(
+                        list(WOVar.wo_php_versions.values())):
+                    short = ver_num.replace('.', '')
+                    if os.path.exists(
+                            '/usr/local/lsws/lsphp{0}/bin/lsphp'
+                            .format(short)):
+                        default_php_short = short
+                        break
 
             # Deploy main httpd_config.conf
             data = dict(
@@ -181,15 +192,20 @@ def post_pref(self, apt_packages, packages, upgrade=False):
                                    .format(ngxroot))):
                 SSL.selfsignedcert(self, proftpd=False, backend=True)
 
-            # Deploy OLS admin password via admpass.sh
-            if os.path.isfile('/usr/local/lsws/admin/misc/admpass.sh'):
-                try:
-                    WOShellExec.cmd_exec(
-                        self,
-                        '/usr/local/lsws/admin/misc/admpass.sh '
-                        '--password "{0}"'.format(passwd))
-                except CommandExecutionError as e:
-                    Log.debug(self, "{0}".format(e))
+            # Set OLS WebAdmin password directly
+            # (admpass.sh is interactive-only and hangs in automation)
+            admin_htpasswd = '/usr/local/lsws/admin/conf/htpasswd'
+            try:
+                WOShellExec.cmd_exec(
+                    self, "printf \"admin:"
+                    "$(openssl passwd -apr1 "
+                    "{password} 2> /dev/null)\n\""
+                    "> {htpasswd} "
+                    "2>/dev/null"
+                    .format(password=passwd,
+                            htpasswd=admin_htpasswd))
+            except CommandExecutionError as e:
+                Log.debug(self, "{0}".format(e))
 
             # traffic advice file
             data = dict(release=WOVar.wo_version)