Scrub docs/scripts of example passwords and host paths.

Stop shipping punimtag_password / admin defaults in install helpers and
docs; generate secrets at install time; require ADMIN_PASSWORD from env
(with test-only bootstrap in conftest).

backend/api/auth.py

@@ -79,9 +79,9 @@ ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = 360
 REFRESH_TOKEN_EXPIRE_DAYS = 7
 
-# Single user mode placeholder - read from environment or use defaults
+# Single-user bootstrap from env only (no default password in source)
 SINGLE_USER_USERNAME = os.getenv("ADMIN_USERNAME", "admin")
-SINGLE_USER_PASSWORD = os.getenv("ADMIN_PASSWORD", "admin")  # Change in production
+SINGLE_USER_PASSWORD = os.getenv("ADMIN_PASSWORD", "")  # empty = env bootstrap disabled
 
 
 def create_access_token(data: dict, expires_delta: timedelta) -> str:
@@ -200,8 +200,8 @@ def _resolve_user_role(user: User | None, is_admin_flag: bool) -> str:
 def login(credentials: LoginRequest, db: Session = Depends(get_db)) -> TokenResponse:
     """Authenticate user and return tokens.
     
-    First checks main database for users, falls back to hardcoded admin/admin
-    for backward compatibility.
+    First checks main database for users, then optional ADMIN_USERNAME /
+    ADMIN_PASSWORD from the environment (no default password in source).
     """
     # First, try to find user in main database
     user = db.query(User).filter(User.username == credentials.username).first()
@@ -245,9 +245,10 @@ def login(credentials: LoginRequest, db: Session = Depends(get_db)) -> TokenResp
             password_change_required=user.password_change_required,
         )
     
-    # Fallback to hardcoded admin/admin for backward compatibility
+    # Optional env bootstrap (ADMIN_PASSWORD must be set and non-empty)
     if (
-        credentials.username == SINGLE_USER_USERNAME
+        SINGLE_USER_PASSWORD
+        and credentials.username == SINGLE_USER_USERNAME
         and credentials.password == SINGLE_USER_PASSWORD
     ):
         access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
@@ -259,7 +260,7 @@ def login(credentials: LoginRequest, db: Session = Depends(get_db)) -> TokenResp
         return TokenResponse(
             access_token=access_token,
             refresh_token=refresh_token,
-            password_change_required=False,  # Hardcoded admin doesn't require password change
+            password_change_required=False,
         )
     
     raise HTTPException(