fix(auth): set subsonic_password on admin bootstrap

Bootstrap was creating password_hash + api_token but leaving
subsonic_password nil, which meant Subsonic clients (Feishin, Symfonium)
got ErrTokenNotSupported on t+s auth — the server had no plaintext to
hash against. Mirror the bootstrap password into subsonic_password so
the admin can sign in to Subsonic clients with the same credential
printed on first boot. Plaintext at rest is the cost of Subsonic's
legacy auth; matches Navidrome's posture.

Also folds in the local dev compose tweaks: dedicated bridge network
with postgres unpublished from the host, and a bind-mount aimed at the
operator's real library path.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -16,8 +16,10 @@ services:
       POSTGRES_USER: minstrel
       POSTGRES_PASSWORD: minstrel
       POSTGRES_DB: minstrel
-    ports:
-      - "5432:5432"
+    networks:
+      - minstrel
+    # ports:
+    #   - "5432:5432"
     volumes:
       - minstrel-pgdata:/var/lib/postgresql/data
     healthcheck:
@@ -40,12 +42,17 @@ services:
       # SMARTMUSIC_AUTH_ADMIN_PASSWORD left unset on purpose — bootstrap
       # generates one and prints it to stderr on first boot. Watch the logs
       # of the minstrel service the first time you bring the stack up.
+    networks:
+      - minstrel
     ports:
       - "4533:4533"
     volumes:
       # Point ./music at your test library (symlink, bind-mount, whatever).
       # Read-only so a buggy scanner can't rewrite your files.
-      - ./music:/music:ro
+      - /mnt/Media/Music:/music:ro
 
 volumes:
   minstrel-pgdata:
+
+networks:
+  minstrel: