I found all the bits (Pi3B, PoE splitter, USB caddy, SATA spinner, SD card) to cobble together my low power always-on "server" to allow me to turn off the power-hungry server when it's not specifically required.
Used the latest RPi Imager, chose PiOS Lite, told it to enable SSH, set a username and password, wrote the image, insert SD card, no keyboard/HDMI connected, plug into ethernet, powers and boots.
Find the DHCP addr from my router, using PuTTY I can SSH to the machine, give it the username and password I set earlier, but it just says "Access Denied", wipe and repeat in case I fumbled setting the password, same problem.
What's the point of setting SSH credentials that it won't let you use?