Add lock_passwd false to Alpine user config

cloud-init/user-data-alpine.yml.tftpl

@@ -8,10 +8,19 @@ preserve_hostname: false
 # 2. User creation
 # On Alpine, the privilege escalation group is "wheel" (not "sudo").
 # Keep the default shell (ash/busybox) to stay lightweight.
+#
+# IMPORTANT: lock_passwd MUST be false on Alpine.
+# cloud-init's default (lock_passwd: true) sets shadow to "!", which Alpine's
+# OpenSSH (compiled without PAM) interprets as "account locked" and refuses
+# pubkey auth with "User ... not allowed because account is locked".
+# Setting lock_passwd: false lets cloud-init use "*" instead: no password
+# login possible, but pubkey works.
 users:
   - name: ${username}
     sudo: ALL=(ALL) NOPASSWD:ALL
     groups: wheel
+    shell: /bin/ash
+    lock_passwd: false
     ssh_authorized_keys:
       - ${ssh_key}