Restore from Gitea ZIP snapshot (12.08.2026) after full instance reinstall

Git history was lost when the previous Gitea instance was wiped and
reinstalled due to an unresolved corruption bug — this commit is the
last known-good file content, exported before the reinstall. Prior
commit history is not recoverable through this path.

scripts/bootstrap-admin.ts

@@ -0,0 +1,46 @@
+/**
+ * Creates the initial admin user from ADMIN_BOOTSTRAP_EMAIL /
+ * ADMIN_BOOTSTRAP_PASSWORD if no user with that email exists yet.
+ * Safe to run on every container start — idempotent.
+ */
+import { db } from "../src/lib/db/client";
+import { users } from "../src/lib/db/schema";
+import { hashPassword } from "../src/lib/auth/password";
+
+async function main() {
+  const email = process.env.ADMIN_BOOTSTRAP_EMAIL;
+  const password = process.env.ADMIN_BOOTSTRAP_PASSWORD;
+  const name = process.env.ADMIN_BOOTSTRAP_NAME ?? "Admin";
+
+  if (!email || !password) {
+    console.log("ADMIN_BOOTSTRAP_EMAIL/PASSWORD not set — skipping admin bootstrap.");
+    return;
+  }
+
+  const normalizedEmail = email.toLowerCase().trim();
+  const existing = await db.query.users.findFirst({
+    where: (u, { eq }) => eq(u.email, normalizedEmail),
+  });
+
+  if (existing) {
+    console.log(`Admin user ${normalizedEmail} already exists — skipping.`);
+    return;
+  }
+
+  const passwordHash = await hashPassword(password);
+  await db.insert(users).values({
+    email: normalizedEmail,
+    passwordHash,
+    name,
+    role: "admin",
+  });
+
+  console.log(`Bootstrapped admin user ${normalizedEmail}.`);
+}
+
+main()
+  .then(() => process.exit(0))
+  .catch((err) => {
+    console.error("Admin bootstrap failed:", err);
+    process.exit(1);
+  });

scripts/generate-key.ts

@@ -0,0 +1,7 @@
+/**
+ * Generates a fresh AES-256-GCM key for CREDENTIALS_ENCRYPTION_KEY.
+ * Usage: npm run generate-key
+ */
+import crypto from "node:crypto";
+
+console.log(crypto.randomBytes(32).toString("base64"));