fix: comprehensive security, performance, and quality hardening

Security: apply AdminOnly middleware to mutating routes, require
ENCRYPTION_KEY and ADMIN_PASSWORD (no insecure defaults), restrict
CORS to same-origin, fix OIDC token delivery via cookie instead of
URL query param, add rate limiting on login, add MaxBytesReader,
validate volume paths against traversal, add security headers,
validate user roles, add Secure flag to OIDC cookie.

Performance: set SQLite MaxOpenConns(1) to prevent SQLITE_BUSY,
add FK indexes on 8 columns, track notifier goroutines with
WaitGroup for graceful shutdown, use GetRegistryByName instead of
GetAllRegistries in deployer, pass basePath param to avoid redundant
settings query, return empty slices from store to remove reflection.

Quality: refactor TriggerDeploy to delegate to runDeploy (~100 lines
removed), consolidate duplicated utilities (extractPort, boolToInt,
now, isTerminalStatus) into shared exports, migrate all log.Printf
to slog structured logging, use consistent webhook response envelope,
remove dead code (parseEnvVars, duplicate auth types).

UX: clean up NPM proxy on instance removal via API, add README with
quickstart guide, add .env.example, require ADMIN_PASSWORD in
docker-compose, document staging-net prerequisite.

cmd/server/main.go

@@ -49,6 +49,13 @@ func main() {
 	}
 	defer db.Close()
 
+	// Derive encryption key from environment (required).
+	encKey, err := crypto.KeyFromEnv()
+	if err != nil {
+		slog.Error("ENCRYPTION_KEY is required — set it to a random 32+ character string")
+		os.Exit(1)
+	}
+
 	// Import seed config on first launch (idempotent).
 	seedPath := envOrDefault("SEED_FILE", "./docker-watcher.yaml")
 	if err := config.ImportSeed(db, seedPath); err != nil {
@@ -56,13 +63,6 @@ func main() {
 		os.Exit(1)
 	}
 
-	// Derive encryption key from environment.
-	encKey, err := crypto.KeyFromEnv()
-	if err != nil {
-		slog.Warn("encryption key not set, using default", "warning", err.Error())
-		encKey = crypto.DeriveKey("docker-watcher-default-key")
-	}
-
 	// Ensure default admin user exists on first launch.
 	if err := ensureDefaultAdmin(db); err != nil {
 		slog.Error("ensure default admin", "error", err)
@@ -116,7 +116,7 @@ func main() {
 	}
 
 	// Build API server.
-	apiServer := api.NewServer(db, dockerClient, dep, webhookHandler, eventBus, encKey)
+	apiServer := api.NewServer(db, dockerClient, npmClient, dep, webhookHandler, eventBus, encKey)
 	router := apiServer.Router()
 
 	// Serve embedded static files for the SPA frontend.
@@ -160,8 +160,9 @@ func main() {
 	// Stop accepting new work.
 	poller.Stop()
 
-	// Drain in-progress deploys.
+	// Drain in-progress deploys and notifications.
 	dep.Drain()
+	notifier.Drain()
 
 	// Shut down HTTP server.
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
@@ -198,7 +199,11 @@ func ensureDefaultAdmin(db *store.Store) error {
 		return nil // Users already exist, skip.
 	}
 
-	password := envOrDefault("ADMIN_PASSWORD", "admin")
+	password := os.Getenv("ADMIN_PASSWORD")
+	if password == "" {
+		slog.Error("ADMIN_PASSWORD is required on first launch — set it to a secure password")
+		os.Exit(1)
+	}
 	hash, err := auth.HashPassword(password)
 	if err != nil {
 		return err