chore: align Caddy port (8080), add DB_CONTAINER env, improve init script

- Caddyfile: listen on :8080 (matches Synology port mapping)
- docker-compose.yml: Caddy ports 8080:8080 / 8443:8443, add DB_CONTAINER
- init-admin.sh: use DB_CONTAINER, stronger password generation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Caddyfile

@@ -5,7 +5,7 @@
 
 # Catch-all: Synology forwards decrypted HTTP traffic to this port.
 # Route based on path regardless of Host header.
-:80 {
+:8080 {
     @api path /api/*
     handle @api {
         reverse_proxy api:3001 {

docker-compose.yml

@@ -31,6 +31,7 @@ services:
       DB_USER: ${POSTGRES_USER:-vidreview}
       DB_PASS: ${POSTGRES_PASSWORD:?Required}
       API_CONTAINER: vidreview-api
+      DB_CONTAINER: vidreview-db
       OUTPUT_DIR: /seed-output
       ADMIN_EMAIL: ${ADMIN_EMAIL:-admin@vidreview.local}
       ADMIN_NAME: ${ADMIN_NAME:-Admin}
@@ -100,8 +101,8 @@ services:
     image: caddy:2-alpine
     container_name: vidreview-caddy
     ports:
-      - '${CADDY_HTTP_PORT:-80}:80'
-      - '${CADDY_HTTPS_PORT:-443}:443'
+      - '${CADDY_HTTP_PORT:-8080}:8080'
+      - '${CADDY_HTTPS_PORT:-8443}:8443'
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - caddy_data:/data

scripts/init-admin.sh

@@ -4,6 +4,7 @@
 #   - UPDATE: skips, leaves DB and data intact
 
 DB_HOST="${DB_HOST:-vidreview-db}"
+DB_CONTAINER="${DB_CONTAINER:-$DB_HOST}"
 DB_NAME="${DB_NAME:-vidreview}"
 DB_USER="${DB_USER:-vidreview}"
 OUTPUT_DIR="${OUTPUT_DIR:-/seed-output}"
@@ -12,7 +13,7 @@ ADMIN_NAME="${ADMIN_NAME:-Admin}"
 API_CONTAINER="${API_CONTAINER:-vidreview-api}"
 
 run_psql() {
-  docker exec "$DB_HOST" psql -U "$DB_USER" -d "$DB_NAME" "$@" 2>&1
+  docker exec "$DB_CONTAINER" psql -U "$DB_USER" -d "$DB_NAME" "$@" 2>&1
 }
 
 run_node() {
@@ -67,7 +68,7 @@ fi
 echo ""
 echo "  FRESH DEPLOY: setting up initial account"
 
-RANDOM_PASS="vid-$(date +%s)-$(head -c 10 /dev/urandom | tr -dc 'a-z0-9')"
+RANDOM_PASS="$(head -c 32 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9!@#$%' | head -c 24)"
 echo "  Password generated."
 
 PASS_HASH=$(run_node -e "require('bcryptjs').hash('$RANDOM_PASS',10).then(h=>process.stdout.write(h)).catch(e=>{console.error(e);process.exit(1)})")