chore(platform): retire ADMIN_PASSWORD from the dev stack

No more shared instructor password env var — the api service now needs only
PROVISIONER_SHARED_SECRET. First-run setup is npm run bootstrap-owner instead.

platform/docker-compose.dev.yml

@@ -68,8 +68,11 @@ services:
       PLATFORM_DB_URL: postgres://postgres:postgres@localhost:5433/rootnode_platform
       PROVISIONER_URL: "http://localhost:4100"
       PROVISIONER_SHARED_SECRET: ${PROVISIONER_SHARED_SECRET:?set a real secret, do not use a default}
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set an instructor password, do not use a default}
       PLATFORM_API_PORT: "4300"
+      # No ADMIN_PASSWORD anymore (Phase 3A) — instructor accounts live in Postgres, created via
+      # `npm run bootstrap-owner` for the first owner and the admin portal after that.
+      # COOKIE_SECURE: "1"   # set once served over real HTTPS
+      # TRUST_PROXY: "1"     # set once fronted by a trusted reverse proxy
     depends_on:
       postgres:
         condition: service_healthy