fix: require admin credentials from env and block defaults in production

[kutluhaneth46]

Summary

Require ADMIN_EMAIL and ADMIN_PASSWORD environment variables for first-run admin bootstrap — no hardcoded credentials in source.

• Production refuses documented defaults (admin@admin.com, 123456, and other banned passwords).
• auth-button.tsx uses ADMIN_EMAIL for admin detection (consistent with dashboard).
• README and .env.example updated.

Fixes #47.

Test plan

• Missing env vars → bootstrap skipped with warning (no user created)
• NODE_ENV=production + default credentials → bootstrap refused
• Custom credentials in .env.local → admin created on first run
• Maintainer confirms SQL credits triggers note in README is acceptable for v1

[kutluhaneth46]

Closing this to reduce open-PR noise and focus my remaining reviews on a smaller set of higher-signal threads.

Happy to reopen later if maintainers still want this change — thanks for your time.

[kutluhaneth46]

Closing this to reduce open-PR noise and focus my remaining reviews on a smaller set of higher-signal threads.

Happy to reopen later if maintainers still want this change — thanks for your time.