fix: sync admin password from .env on startup, add host.docker.internal for local sub2api

- _init_admin now re-hashes password if .env password differs from DB
- docker-compose: add extra_hosts host.docker.internal:host-gateway
  so containers can reach host services via host.docker.internal

backend/app/main.py

@@ -12,7 +12,7 @@ from app.config import get_settings
 from app.database import init_db
 from app.models.admin_user import AdminUser
 from app.database import SessionLocal
-from app.utils.auth import hash_password, validate_password_supported
+from app.utils.auth import hash_password, verify_password, validate_password_supported
 from app.services.scheduler import start_scheduler, stop_scheduler
 from app.routers import auth, upstreams, webhooks, logs, custom_pages, browser_sessions, websites
 from app.services.browser_session_service import browser_sessions as browser_session_service
@@ -38,8 +38,16 @@ def _init_admin() -> None:
     settings = get_settings()
     db = SessionLocal()
     try:
-        exists = db.query(AdminUser).filter(AdminUser.email == settings.admin_email).first()
-        if not exists:
+        existing = db.query(AdminUser).filter(AdminUser.email == settings.admin_email).first()
+        if existing:
+            # Sync password hash if .env has changed since first creation
+            if not verify_password(settings.admin_password, existing.password_hash):
+                existing.password_hash = hash_password(settings.admin_password)
+                db.commit()
+                logger.info("admin password updated: %s", settings.admin_email)
+            else:
+                logger.info("admin user already exists: %s", settings.admin_email)
+        else:
             user = AdminUser(
                 email=settings.admin_email,
                 password_hash=hash_password(settings.admin_password),
@@ -47,8 +55,6 @@ def _init_admin() -> None:
             db.add(user)
             db.commit()
             logger.info("admin user created: %s", settings.admin_email)
-        else:
-            logger.info("admin user already exists: %s", settings.admin_email)
     finally:
         db.close()
 

docker-compose.yml

@@ -7,6 +7,8 @@ services:
     restart: unless-stopped
     ports:
       - "${BIND_HOST:-0.0.0.0}:${SERVER_PORT:-8899}:8000"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     volumes:
       - ./data:/app/data
     environment: