feat: auto-persist JWT secret, remove setup token requirement

- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields

example.env

@@ -63,10 +63,12 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/oxicloud
 # -----------------------------------------------------------------------------
 
 # JWT secret key for signing authentication tokens
-# IMPORTANT: Change this in production! If empty, a random secret is generated
-# per session (tokens become invalid on restart).
-# Generate a secure secret with: openssl rand -hex 32
-OXICLOUD_JWT_SECRET=
+# If not set, a secure secret is auto-generated and persisted to
+# <STORAGE_PATH>/.jwt_secret so tokens survive container restarts.
+# You only need to set this if you want to share the same secret
+# across multiple OxiCloud instances or control it externally.
+# Generate a custom secret with: openssl rand -hex 32
+#OXICLOUD_JWT_SECRET=
 
 # Access token lifetime in seconds (default: 3600 = 1 hour)
 #OXICLOUD_ACCESS_TOKEN_EXPIRY_SECS=3600