style(env): change ADMIN_PW to ADMIN_PASSWORD for consistency

Author: ZoneMix

.env.example

@@ -90,7 +90,7 @@ ADMIN_USER=admin
 #   - At least one special character (!@#$%^&*()_+-=[]{}|;:,.<>?)
 # Example: MySecure123!Password
 # NEVER commit real passwords to version control!
-ADMIN_PW=YourSecure12!PasswordHere
+ADMIN_PASSWORD=Your$ecureP@ssw0rd!
 
 # =============================================================================
 # ACTUAL BUDGET INTEGRATION
@@ -180,7 +180,7 @@ LOG_LEVEL=info
 #   - JWT_SECRET (32+ chars)
 #   - JWT_REFRESH_SECRET (32+ chars, different from JWT_SECRET)
 #   - SESSION_SECRET (32+ chars, different from JWT secrets)
-#   - ADMIN_PW (12+ chars with complexity requirements)
+#   - ADMIN_PASSWORD (12+ chars with complexity requirements)
 #   - ACTUAL_SERVER_URL
 #   - ACTUAL_PASSWORD
 #   - ACTUAL_SYNC_ID
@@ -245,7 +245,7 @@ MAX_REQUEST_SIZE=10kb
 #    openssl rand -hex 64      (for 64-char secrets)
 
 # 2. PASSWORD HASHING:
-#    To hash the ADMIN_PW, use:
+#    To hash the ADMIN_PASSWORD, use:
 #    node -e "const bcrypt = require('bcrypt'); bcrypt.hash('password', 12).then(h => console.log(h));"
 
 # 3. PRODUCTION DEPLOYMENT:

src/auth/user.js

@@ -47,21 +47,21 @@ export const validatePasswordComplexity = (password) => {
 export const ensureAdminUserHash = async () => {
   const db = getDb();
   const adminUsername = process.env.ADMIN_USER || 'admin';
-  const adminPW = process.env.ADMIN_PW;
+  const adminPassword = process.env.ADMIN_PASSWORD;
 
-  if (!adminPW) {
-    logger.error('ADMIN_PW missing – cannot create admin user. Exiting.');
+  if (!adminPassword) {
+    logger.error('ADMIN_PASSWORD missing – cannot create admin user. Exiting.');
     process.exit(1);
   }
 
   // Validate password complexity for new passwords
-  const passwordValidation = validatePasswordComplexity(adminPW);
+  const passwordValidation = validatePasswordComplexity(adminPassword);
   if (!passwordValidation.valid) {
     logger.warn(`Admin password does not meet complexity requirements: ${passwordValidation.message}`);
-    logger.warn('Consider updating ADMIN_PW to meet security standards');
+    logger.warn('Consider updating ADMIN_PASSWORD to meet security standards');
   }
 
-  const hash = await bcrypt.hash(adminPW, 12);
+  const hash = await bcrypt.hash(adminPassword, 12);
 
   const upsert = db.prepare(`
     INSERT INTO users (username, password_hash, is_active)