fix: harden owner bootstrap and auth persistence

compose.yaml

@@ -1,9 +1,8 @@
 name: nexus
-
 services:
   postgres:
     image: postgres:17-alpine
-    restart: unless-stopped
+    restart: always
     deploy:
       resources:
         limits:
@@ -29,22 +28,16 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
-
   api:
     build:
       context: ./backend
-    restart: unless-stopped
+    restart: always
     deploy:
       resources:
         limits:
           memory: 512M
         reservations:
           memory: 128M
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-        max_attempts: 3
-        window: 120s
     environment:
       ASPNETCORE_ENVIRONMENT: Production
       ASPNETCORE_URLS: http://+:8080
@@ -52,12 +45,8 @@ services:
       Jwt__Key: ${JWT_KEY:?Set JWT_KEY in .env}
       Jwt__Issuer: ${JWT_ISSUER:-nexus}
       Jwt__Audience: ${JWT_AUDIENCE:-nexus-web}
-      Owner__Email: ${OWNER_EMAIL:?Set OWNER_EMAIL in .env}
-      # OWNER_PASSWORD is only used during initial seed (first deploy).
-      # After that the DB is the single source of truth, enforced by SeedAudit.
-      # Default: empty (seed uses a random password if unset on first run).
-      Owner__Password: ${OWNER_PASSWORD:-}
-      Owner__DisplayName: ${OWNER_DISPLAY_NAME:-Owner}
+      Bootstrap__OwnerEmail: ${BOOTSTRAP_OWNER_EMAIL:?Set BOOTSTRAP_OWNER_EMAIL in .env}
+      # Initial owner password is generated once at first seed and then lives only in the DB.
       Integrations__OpenClaw__BaseUrl: ${OPENCLAW_BASE_URL:-http://host.docker.internal:18789}
       Integrations__OpenClaw__Token: ${OPENCLAW_GATEWAY_TOKEN:-}
       Integrations__OpenClaw__Password: ${OPENCLAW_GATEWAY_PASSWORD:-}
@@ -91,22 +80,16 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
-
   web:
     build:
       context: ./frontend
-    restart: unless-stopped
+    restart: always
     deploy:
       resources:
         limits:
           memory: 128M
         reservations:
           memory: 32M
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-        max_attempts: 3
-        window: 120s
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.nexus.rule=Host(`nexus.noveria.net`)"
@@ -133,13 +116,11 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
-
 networks:
   nexus:
   openclaw_default:
     external: true
   proxy:
     external: true
-
 volumes:
   nexus-postgres: