fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.

ADR.md

@@ -913,7 +913,7 @@ ticket gets the shell. The WebSocket of RFC 6455 is implemented on the standard
 web service's `http.server`, server side only, without extensions. `systemd-run --pty` starts the
 shell in a transient unit with a PAM login session, outside the sandbox, and `setsid --ctty`
 makes the terminal its controlling terminal so window sizes reach the shell. A shell idle for
-`web.shell_idle_minutes` is closed, and the journal records every opening and end. The Router
+`web.shell_idle_minutes` is closed, and the journal records every opening, end and refusal. The Router
 Manager checks the session and the WebSocket's origin, and relays the bytes to the router after
 both handshakes.