Docs: make init in the setup steps

development.md

@@ -15,7 +15,10 @@ root `.env` — change it there and re-run `make init`. `app/Makefile` takes tha
 default only (`export DOMAIN ?= …`), so `make dev DOMAIN=…` overrides it and the override
 reaches the recipes.
 
-**App only.** `cd app && make dev` starts this stack on its own Traefik with all host ports
+**App only.** In a bare clone of this repo, `make init` once (`.env` from `.env.example`
+with generated secrets, the `proxy` docker network, prints the admin login), then
+`make dev-local` serves the stack detached at `http://app.localhost` behind Traefik on
+port 80. `make dev` starts this stack on its own Traefik with all host ports
 published, in the foreground. `make dev-utils` starts just proxy and mailcatcher — the
 useful half when the backend runs on the host.
 

docs/getting-started/facility-automation.md

@@ -40,17 +40,20 @@ Clone the app repository and write its one configuration file:
 ```sh
 git clone https://git.stroblme.de/Fluksio/app.git ~/fluksio
 cd ~/fluksio
-cp .env.example .env
+make init                   # writes .env, generates its secrets, prints the admin login
 $EDITOR .env                # FIRST_SUPERUSER, ENVIRONMENT=production
 ```
 
+`make init` is safe to run again: it only fills secrets still set to
+`changethis`, and `.env` otherwise stays as you left it.
+
 `.env` is the whole configuration. The four settings that matter on day one:
 
 | Setting | What it does |
 |---|---|
 | `DOMAIN` | the hostname everything is served under, if you use one. Left alone it only names the issuer that agents authenticate against |
 | `FIRST_SUPERUSER` | the account you sign in with |
-| `FIRST_SUPERUSER_PASSWORD` | leave it as `changethis` and one is generated for you |
+| `FIRST_SUPERUSER_PASSWORD` | generated by `make init`; it prints it, and it stays in `.env` |
 | `ENVIRONMENT` | `production` closes the interactive API schema; `local` leaves it open |
 
 Everything the instance owns (the database, your flows, secrets, artifacts,