Root cause: .env.example used relative paths (./data/...) which resolve
to /app/data/ inside the container instead of the persistent volume at
/data/. This caused the database to be recreated on every container
restart, resetting the admin password to a new initial value.
Fixes:
- .env.example: comment out path settings with clear warning about
relative paths; Dockerfile already provides correct absolute defaults
- auth: add initial_setup_complete flag in settings table as
defence-in-depth so EnsureAdmin never re-creates an admin after
the initial setup, even if the users table is unexpectedly empty
- main: add validateDataPaths() startup check that warns when relative
container paths are detected (potential data-loss misconfiguration)
- auth_test: extend TestEnsureAdmin to verify the flag prevents
admin re-creation after user deletion
