I have now got it working on my machine.
If anyone wants to try the revised code it's at:
github.com/ken-self/indiwebmanager
If it works OK for everyone then I can raise a PR
To get it to work I did the following:
Added a control to the web page to capture a sudo password (see form.tpl)
Send the password in JSON with the POSTed reboot and poweroff commands (see indi.js)
If password is not specified perform the reboot/poweroff without sudo (see main.py)
Otherwise perform the reboot/poweroff with sudo using option -k to force prompt for password and -S to take password input from STDIN
Replaced the reboot and poweroff cammands with shutdown -r/-P so I could then add a delay of 1 minute. That way, if it works a success response is received by the web client. Otherwise it would error as the server would shut down right away before posting success.
Any error in the sudo or shutdown commands result in an error response to the web client
Possible improvements:
Work out how to get rid of the "Sorry, try again" message from sudo which gets logged when the password is incorrect
Clear out the password control after executing the reboot/shutdown
Change message seen by user to "Reboot in in one minute" rather than "Reboot succeeded"
Add a button to cancel reboot/poweroff
ETA: Only stop the server if shutdown is successfully scheduled. Or don't even bother as it wil stop when the system shuts down anyway