feat: add backup recovery, setup wizard and user-view guards

.env.example

@@ -11,7 +11,12 @@ LOG_FORMAT=text
 JWT_SECRET=replace-with-at-least-32-random-characters
 SETTINGS_ENCRYPTION_KEY=replace-with-a-valid-fernet-key
 ADMIN_USERNAME=admin
-ADMIN_PASSWORD=replace-with-a-strong-bootstrap-password
+# Recommended fresh install: generate a separate random setup token. Open /setup
+# to create the administrator and connect your apps; remove this after finishing.
+SETUP_TOKEN=replace-with-a-separate-random-setup-token
+# Alternatively pre-create the first admin with a unique password (12+ chars).
+# Leave blank to create the account using the setup wizard and SETUP_TOKEN.
+ADMIN_PASSWORD=
 
 AUTH_COOKIE_SECURE=false
 AUTH_COOKIE_SAMESITE=strict