feat: HMAC-signed cookies for UI sessions, bcrypt hash for admin bootstrap, simplified NixOS module

.env.example

@@ -5,11 +5,14 @@ QDRANT_PORT=6334
 OPENAI_API_KEY=sk-...
 # EMBEDDING_BASE_URL=https://api.openai.com
 EMBEDDING_MODEL=text-embedding-3-small
-# Admin user bootstrap credentials
-ADMIN_USERNAME=admin
-ADMIN_PASSWORD=change-me
-# Optional: initial MCP session token for backward compatibility
+# Admin user bootstrap: bcrypt hash of the admin password (preferred)
+# Generate: go run golang.org/x/crypto/bcrypt/cmd/...  or  htpasswd -bnBC 10 "" "your-password" | tr -d ':\n'
+# ADMIN_PASSWORD_HASH=$2b$10$...
+# Fallback: plaintext password (less secure)
+# ADMIN_PASSWORD=change-me
+# ADMIN_USERNAME=admin
+# Optional: bootstrap an API session token
 # MCP_TOKEN=legacy-token
 PORT=8080
 SQLITE_PATH=flashcard.db
-HMAC_KEY_FILE=.secret
+# HMAC_KEY_FILE=.secret (default)