The root-install instructions assumed an account the machine may not have

The hint said to run 'sudo visudo' as though the account running the command already had
sudo. On a machine set up the way this one was - a separate administrator, then a
daily-use account - the daily-use account is not in the sudo group, so that instruction
could not be followed by the person who needed it. Replaced with the two steps that
actually apply, in order:

1. The account running the command must be in the sudo group. Check with 'id -nG'; if it
   is not there, an administrator adds it with 'usermod -aG sudo <account>' and the
   account signs out and back in, because group membership is fixed at sign-in. This is
   the step that was missing, and it is the one that cannot be done by the person stuck.
2. Passwordless sudo, from an account that already has sudo: 'sudo visudo -f
   /etc/sudoers.d/umbra-node', add the NOPASSWD line, save. Optional - without it the
   command still works and simply prompts.

Written after a run stopped at a sudo password prompt with nothing on screen but 'Sorry,
try again.', which is sudo's own message and appears nowhere in this codebase, so the
failure looked like the system refusing rather than the shell asking.

Checked against 238: umbra is already in the sudo group, so only step 2 applies there.

web/assets/styles.css

@@ -410,3 +410,22 @@ html.modal-open { overflow: hidden; }
   .admin-table--wide, .admin-table--audit { min-width: 46rem; }.otp-value-row .button { width: 100%; }
   .pagination { justify-content: stretch; }.pagination__info { width: 100%; }.pagination__buttons .button { flex: 1; }
 }
+
+/* The sudo prerequisites beside the "expect to run as root" checkbox. Two steps, and
+   the second cannot be run until the first is true, so they are numbered rather than
+   left as a paragraph. Deliberately plain: this is read on the machine it describes. */
+.root-access-steps {
+  margin: .55rem 0 0;
+  padding-left: 1.15rem;
+  color: var(--admin-muted);
+  font-size: .67rem;
+  line-height: 1.6;
+}
+.root-access-steps li { margin-bottom: .5rem; }
+.root-access-steps strong { color: #e2e8f0; font-weight: 700; }
+.root-access-steps code {
+  color: var(--admin-lilac);
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: .95em;
+  word-break: break-all;
+}

web/uadmin/nodes.html

@@ -142,14 +142,35 @@
               <label for="node-as-root">
                 Expect to run as root on an exclusive machine
               </label>
-              <small class="field-hint">
+              <small class="field-hint" id="root-access-hint">
                 Ticking this changes the command below to <code>curl … | sudo sh</code> and
-                installs to <code>/opt/umbra</code> with a system service running as its own
+                installs to <code>/opt/umbra</code> as a system service running as its own
                 <code>umbra-node</code> account. Unticked, everything stays in your home
-                directory with a user service. The script still checks for root when it
-                runs, so it does the right thing either way — but the paths it writes to
-                are chosen here, so a mismatch would fail.
+                directory with a user service and no password is needed.
               </small>
+              <ol class="root-access-steps">
+                <li>
+                  <strong>The account running the command must be in the
+                  <code>sudo</code> group.</strong> On a machine set up with a separate
+                  administrator and then a daily-use account, the first account created is
+                  the one that gets <code>sudo</code>; a later account does not. Check
+                  with <code>id -nG</code>. If <code>sudo</code> is not listed, an
+                  administrator adds it:
+                  <code>sudo usermod -aG sudo <var>account</var></code>
+                  then sign out and back in — group membership is fixed at sign-in.
+                </li>
+                <li>
+                  <strong>To avoid typing a password for every node</strong>, grant
+                  passwordless sudo for that one account. Run this
+                  <em>from an account that already has sudo</em>:
+                  <code>sudo visudo -f /etc/sudoers.d/umbra-node</code>
+                  then add this line and save:
+                  <code>umbra ALL=(ALL) NOPASSWD: ALL</code>
+                  Replace <code>umbra</code> with whichever account will run the command.
+                  Without this step the command still works — it will simply ask for a
+                  password each time.
+                </li>
+              </ol>
             </div>
 
             <div class="modal-actions">