Set compose ADMIN_PORT/PROXY_* to 81/80/443 so healthcheck and EXPOSE match; document binary defaults vs Docker ports in README. Fixes #10
Admin tokens were forgeable whenever JWT_SECRET was unset. Prefer the env var, otherwise write a random key to data/.jwt_secret.