add auth

.env.example

@@ -2,3 +2,19 @@
 # Library paths you configure in the app must be subdirectories of this path.
 # Inside the container, this maps to /media.
 MEDIA_ROOT=/mnt/nas
+
+# Authentication settings
+# SECRET_KEY is used to sign JWT tokens. Leave unset to auto-generate one
+# (all sessions will be invalidated on restart).
+SECRET_KEY=
+
+# Admin user created on first startup.
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=change-me
+
+# JWT token expiry in days (default: 30).
+ACCESS_TOKEN_EXPIRE_DAYS=30
+
+# Gitea container registry owner (username or org). Used by docker-compose.yml
+# to pull pre-built images. Defaults to "gpatti".
+OWNER=gpatti