feat: auth

.env.example

@@ -5,6 +5,15 @@ COMPOSE_PROJECT_NAME=model-platform
 # network. Override here to expose Nginx on a different host port.
 GATEWAY_PORT=8888
 
+# ============================================================================
+# CRITICAL: must set BEFORE first run. The initial admin user is seeded by
+# the auth-bootstrap migration (migrations/versions/9a1b2c3d4e5f_*.py)
+# with this password as a bcrypt hash. If you leave the default in any
+# non-local environment you will get pwned. The default exists only to
+# keep `docker compose up` working in dev.
+# ============================================================================
+INITIAL_ADMIN_PASSWORD=admin12345
+
 # MySQL connection URI (async SQLAlchemy driver)
 DATABASE_URL=mysql+asyncmy://model_platform:ChangeMe_MySQL_App_2026@mysql:3306/model_platform?charset=utf8mb4
 
@@ -23,4 +32,5 @@ RUSTFS_ENDPOINT=http://rustfs:9000
 RUSTFS_ACCESS_KEY=modelplatform
 RUSTFS_SECRET_KEY=ChangeMe_RustFS_2026
 RUSTFS_WORKSPACE_BUCKET=workspaces
-
+RUSTFS_TRASH_BUCKET=trash
+RUSTFS_TRASH_RETENTION_DAYS=30