docs: keep only reference documentation, archive one-offs

docs/development.md

@@ -29,6 +29,37 @@ just migrate               # create/update the SQLite DB from schema + migration
 not the live-reload watcher. Prefer the explicit `composer install` + `npm ci`
 above.
 
+### APP_KEY and the app/.env file
+
+The app derives DB/storage paths from the filesystem layout, so the public site
+and admin panel run without any env file. But `Crypto` (decrypting the SMTP
+password, PeerTube credentials, and Nextcloud WebDAV sync) requires an
+`app/.env` containing an `APP_KEY`:
+
+```
+APP_KEY=<base64-encoded 32 random bytes>
+```
+
+Generate one with:
+
+```bash
+php -r 'echo "APP_KEY=" . base64_encode(random_bytes(32)) . PHP_EOL;' > app/.env
+chmod 600 app/.env
+```
+
+`app/.env` must **never** be committed. If the file is missing, the public site
+still runs but any path that reads encrypted credentials throws
+`RuntimeException: APP_KEY not found`. On a fresh clone, create it before
+relying on SMTP/PeerTube/Nextcloud features.
+
+### First admin login
+
+A brand-new DB seeds `site_settings.admin_password_hash` as an **empty string**,
+which makes `AdminAuth::requireLogin()` a pass-through — i.e. `/admin/` starts
+**unauthenticated** until a password is set. To secure it, open
+`http://127.0.0.1:8000/admin/account` (or the production admin) and set the
+admin password, which stores the bcrypt hash in `site_settings`.
+
 ## Project Structure
 
 ```
@@ -136,7 +167,8 @@ just reset-db       # rm DB + init-db
 just query          # open an interactive SQLite shell
 just backup         # SQL dump into app/storage/backup_<timestamp>.sql
 just backup-snapshot # WAL-safe hot backup + gzip into storage/backups/
-just cleanup-drafts [--no-dry-run]   # remove orphaned drafts > 24h
+just cleanup-drafts [--no-dry-run]   # remove orphaned drafts > 7 days (default)
+                                     # OLDER_THAN_HOURS=24 to change the threshold
 ```
 
 See [database.md](database.md) for the full schema reference.