The first admin gets a random password, not admin / ipodderx (#321)

A database with no accounts created admin with the hard-coded password
ipodderx, published in the README, the docs and the sample compose
file, and the log line announcing it printed the password. /api/login
is open to anyone who reaches the port, and nothing made anyone change
it, so a fresh install was an admin account anyone could sign into.

Now the password is IPX_ADMIN_PASSWORD when set, for scripted installs,
or 24 random hex characters written to admin-password beside
config.toml, created 0600 so it is never readable by others even for a
moment. The log says where it is, never what it is, as it does for the
web token (#40). Existing databases are untouched: seeding runs only
with no accounts at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/users.md

@@ -51,8 +51,9 @@ Three ways, tried in order of how specific the claim is:
 3. **The shared `[web] token`**, which signs in as the admin — this is what the Docker healthcheck
    and any scripts use.
 
-A database with no accounts creates **admin / ipodderx** on the next daemon start and says so in
-the log. Change it:
+A database with no accounts creates **admin** on the next daemon start, with the password in
+`IPX_ADMIN_PASSWORD` if it is set, or a random one written to `admin-password` beside config.toml,
+readable by ipx's user alone. The log says where the password is, never what it is. Change it:
 
 ```sh
 echo -n 'a good password' | ipx user passwd admin