The first admin gets a random password, not admin / ipodderx (#321)

A database with no accounts created admin with the hard-coded password
ipodderx, published in the README, the docs and the sample compose
file, and the log line announcing it printed the password. /api/login
is open to anyone who reaches the port, and nothing made anyone change
it, so a fresh install was an admin account anyone could sign into.

Now the password is IPX_ADMIN_PASSWORD when set, for scripted installs,
or 24 random hex characters written to admin-password beside
config.toml, created 0600 so it is never readable by others even for a
moment. The log says where it is, never what it is, as it does for the
web token (#40). Existing databases are untouched: seeding runs only
with no accounts at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,6 +1,7 @@
 # A sample: ipx with its database in SQLite, and ipx-web, the page, in front of it. Build both
 # images first (`docker build -t ipx .` and `docker build -f Dockerfile.web -t ipx-web .`), then
-# `docker compose up -d`, and sign in at http://<host>:8099 as admin / ipodderx.
+# `docker compose up -d`, and sign in at http://<host>:8099 as admin, with the password the first
+# start writes to the config volume: `docker exec ipx cat /config/admin-password`.
 # docs/configuration.md has the rest, Postgres included.
 services:
   ipx: