fix(users): add no unrestricted key next to forced commands

The for loop's else branch always ran, so every authorized user with
commands also got its key without restriction; root on every node had
a full shell as wol on the waker.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RywMtsL8qXG7GDY3MHq9Uh

bundles/users/metadata.py

@@ -26,7 +26,7 @@ def authorized_users(metadata):
 
             for command in options.get('commands', []):
                 users[name]['authorized_keys'].add(f'command="{command}" ' + authorized_user_public_key)
-            else:
+            if not options.get('commands'):
                 users[name]['authorized_keys'].add(authorized_user_public_key)
 
     return {