fix(api): защита секретов в production, redact логов, bootstrap без полного скана users

docker-compose.yml

@@ -6,7 +6,7 @@ services:
       - "8080:8080"
     environment:
       DATABASE_URL: sqlite:/data/app.db
-      JWT_SECRET: ${JWT_SECRET:-change-me-in-production}
+      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env (min 16 chars)}
       JWT_TTL_HOURS: ${JWT_TTL_HOURS:-1}
       REFRESH_TTL_DAYS: ${REFRESH_TTL_DAYS:-14}
       ISSUER: ${ISSUER:-https://auth.shnt.top}
@@ -15,7 +15,7 @@ services:
       # Опционально: PKCS8 PEM RSA. Иначе ключ генерируется и хранится в SQLite (/data).
       OIDC_RSA_PRIVATE_KEY: ${OIDC_RSA_PRIVATE_KEY:-}
       ADMIN_EMAIL: ${ADMIN_EMAIL:-admin@shnt.top}
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env (min 8 chars)}
       ADMIN_NAME: ${ADMIN_NAME:-Admin}
       RETURN_TO_ALLOWLIST: ${RETURN_TO_ALLOWLIST:-.shnt.top,localhost,private}
       LOG_LEVEL: info