Docs sync: align README with current ports/password rules. Co-authored-by: s1d3sw1ped_bot <s1d3sw1ped+giteabot@gmail.com> Co-committed-by: s1d3sw1ped_bot <s1d3sw1ped+giteabot@gmail.com>
Admin tokens were forgeable whenever JWT_SECRET was unset. Prefer the env var, otherwise write a random key to data/.jwt_secret.