feat: auto-persist JWT secret, remove setup token requirement

- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields

example.env

@@ -63,10 +63,12 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/oxicloud
 # -----------------------------------------------------------------------------
 
 # JWT secret key for signing authentication tokens
-# IMPORTANT: Change this in production! If empty, a random secret is generated
-# per session (tokens become invalid on restart).
-# Generate a secure secret with: openssl rand -hex 32
-OXICLOUD_JWT_SECRET=
+# If not set, a secure secret is auto-generated and persisted to
+# <STORAGE_PATH>/.jwt_secret so tokens survive container restarts.
+# You only need to set this if you want to share the same secret
+# across multiple OxiCloud instances or control it externally.
+# Generate a custom secret with: openssl rand -hex 32
+#OXICLOUD_JWT_SECRET=
 
 # Access token lifetime in seconds (default: 3600 = 1 hour)
 #OXICLOUD_ACCESS_TOKEN_EXPIRY_SECS=3600

src/application/dtos/user_dto.rs

@@ -49,13 +49,12 @@ pub struct RegisterDto {
 }
 
 /// DTO for the one-time initial admin setup endpoint (`/api/setup`).
-/// Requires the setup token printed to the server log on first boot.
+/// Available only when the system is not yet initialized (no admin exists).
 #[derive(Debug, Serialize, Deserialize, Clone)]
 pub struct SetupAdminDto {
     pub username: String,
     pub email: String,
     pub password: String,
-    pub setup_token: String,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]