The first admin gets a random password, not admin / ipodderx (#321)

A database with no accounts created admin with the hard-coded password
ipodderx, published in the README, the docs and the sample compose
file, and the log line announcing it printed the password. /api/login
is open to anyone who reaches the port, and nothing made anyone change
it, so a fresh install was an admin account anyone could sign into.

Now the password is IPX_ADMIN_PASSWORD when set, for scripted installs,
or 24 random hex characters written to admin-password beside
config.toml, created 0600 so it is never readable by others even for a
moment. The log says where it is, never what it is, as it does for the
web token (#40). Existing databases are untouched: seeding runs only
with no accounts at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -37,7 +37,8 @@ ipx user rm sam                                       # account, subscriptions a
 ```
 
 The first account created is an admin; later ones are ordinary users. A database with no accounts
-at all gets **admin / ipodderx** on the next daemon start, announced in the log — change it.
+at all gets **admin** on the next daemon start, with a random password in `admin-password` beside
+config.toml (or `IPX_ADMIN_PASSWORD`), announced in the log — change it.
 
 To avoid even the command line, read it interactively:
 

docs/configuration.md

@@ -183,6 +183,7 @@ had it only through the OPML loses it as before. Leaving the OPML yourself keeps
 | Variable | Effect |
 |---|---|
 | `IPX_CONFIG` | Config file path |
+| `IPX_ADMIN_PASSWORD` | The first admin's password, for a database with no accounts; random, in `admin-password` beside config.toml, without it |
 | `IPX_DATA_DIR` | Directory holding `state.db` |
 | `IPX_DATABASE_URL` | A `postgres://user:password@host:port/database` URL: use that database instead of `state.db` |
 | `IPX_TEST_DATABASE_URL` | For `cargo test`: run the database tests on this Postgres database too, each in a schema of its own |

docs/users.md

@@ -51,8 +51,9 @@ Three ways, tried in order of how specific the claim is:
 3. **The shared `[web] token`**, which signs in as the admin — this is what the Docker healthcheck
    and any scripts use.
 
-A database with no accounts creates **admin / ipodderx** on the next daemon start and says so in
-the log. Change it:
+A database with no accounts creates **admin** on the next daemon start, with the password in
+`IPX_ADMIN_PASSWORD` if it is set, or a random one written to `admin-password` beside config.toml,
+readable by ipx's user alone. The log says where the password is, never what it is. Change it:
 
 ```sh
 echo -n 'a good password' | ipx user passwd admin