feat(sp23): auth bootstrap reads CYCLONE_ADMIN_*_FILE for Docker secrets

Add _read_secret() helper that prefers *_FILE env vars (the standard Docker-secret pattern) over bare env vars. Strips trailing whitespace from file contents so printf/echo newlines don't break bcrypt verify. Existing CYCLONE_ADMIN_USERNAME + CYCLONE_ADMIN_PASSWORD still work for non-Docker deployments. Add tests/test_auth_bootstrap_file.py covering: file-path read, file-overrides-bare, bare-fallback, whitespace-stripping, missing-file raises.

backend/src/cyclone/auth/bootstrap.py

@@ -11,6 +11,11 @@ Precedence:
 2. Users table non-empty — no-op.
 3. ``CYCLONE_ADMIN_USERNAME`` + ``CYCLONE_ADMIN_PASSWORD`` env vars set
    (password >= 12 chars) — create the admin and print confirmation.
+   Each env var can also be replaced by a ``*_FILE`` companion
+   (``CYCLONE_ADMIN_USERNAME_FILE`` / ``CYCLONE_ADMIN_PASSWORD_FILE``)
+   that points at a file on disk — the standard Docker-secret pattern,
+   used in production to avoid embedding secrets in ``docker-compose.yml``.
+   ``_FILE`` takes precedence when set.
 4. Otherwise — raise ``RuntimeError`` with a remediation hint that
    points operators at ``python -m cyclone users create``.
 """
@@ -18,6 +23,7 @@ Precedence:
 from __future__ import annotations
 
 import os
+from pathlib import Path
 
 from sqlalchemy import select
 
@@ -27,6 +33,21 @@ from cyclone.auth.permissions import Role
 from cyclone.db import SessionLocal, User
 
 
+def _read_secret(env_var: str, file_var: str) -> str | None:
+    """Read a secret from a ``*_FILE`` env var (Docker-secret pattern) first,
+    falling back to the plain env var. Returns None if neither is set.
+    """
+    file_path = os.environ.get(file_var)
+    if file_path:
+        try:
+            return Path(file_path).read_text().strip()
+        except OSError as exc:
+            raise RuntimeError(
+                f"failed to read {file_var}={file_path}: {exc}"
+            ) from exc
+    return os.environ.get(env_var)
+
+
 def run() -> None:
     """Bootstrap the first admin user, or no-op.
 
@@ -42,8 +63,12 @@ def run() -> None:
         _deps.AUTH_DISABLED = True
         return
 
-    username = os.environ.get("CYCLONE_ADMIN_USERNAME")
-    password = os.environ.get("CYCLONE_ADMIN_PASSWORD")
+    username = _read_secret(
+        "CYCLONE_ADMIN_USERNAME", "CYCLONE_ADMIN_USERNAME_FILE"
+    )
+    password = _read_secret(
+        "CYCLONE_ADMIN_PASSWORD", "CYCLONE_ADMIN_PASSWORD_FILE"
+    )
 
     # First-boot fix: ``python -m cyclone`` calls bootstrap before any
     # subcommand or the FastAPI lifespan handler runs, so on a brand-new