setup: read bootstrap DB password from environment

Server container shares the bootstrap .env with postgres, so the
current password is already in our environment. Hardcoded literal
kept only as fallback for the shipped default.

server/internal/api/handlers/setup.go

@@ -8,6 +8,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"net/http"
+	"os"
 	"strconv"
 	"strings"
 
@@ -517,9 +518,14 @@ func (h *SetupHandler) ConfigureServer(c *gin.Context) {
 	}
 	fmt.Println("[WARNING]  SECURITY WARNING: Backup the private key immediately or you will lose access to all agents!")
 
-	// Step 1: Update PostgreSQL password from bootstrap to user password
+	// Step 1: Update PostgreSQL password from bootstrap to user password.
+	// The server container shares the bootstrap .env with postgres, so the
+	// current DB password is in our own environment — don't hardcode it.
 	fmt.Println("Updating PostgreSQL password from bootstrap to user-provided password...")
-	bootstrapPassword := "redflag_bootstrap" // This matches our bootstrap .env
+	bootstrapPassword := os.Getenv("POSTGRES_PASSWORD")
+	if bootstrapPassword == "" {
+		bootstrapPassword = "redflag_bootstrap" // shipped bootstrap .env default
+	}
 	if err := updatePostgresPassword(req.DBHost, req.DBPort, req.DBUser, bootstrapPassword, req.DBPassword); err != nil {
 		fmt.Printf("CRITICAL ERROR: Failed to update PostgreSQL password: %v\n", err)
 		c.JSON(http.StatusInternalServerError, gin.H{