refactor(auth): remove obsolete CONVERT_PASSWORDS env var

Legacy md5/argon2id hashes are now always upgraded to bcrypt on login, so
the CONVERT_PASSWORDS flag is no longer used. Drop it from env schema,
.env.example, the docker installer, and test mocks.

.env.example

@@ -36,9 +36,7 @@ BADGE_URL=/swf/c_images/album1584
 # --- SECURITY & HASHING ---
 AUTH_SECRET=your-super-secret-auth-key-change-this-min-32-chars
 APP_KEY=base64:your-app-key-here=
-# Deprecated: legacy md5/argon2id hashes are ALWAYS upgraded to bcrypt on
-# login now. Kept only for config compatibility with existing deploys.
-# CONVERT_PASSWORDS=true
+# Bcrypt cost factor for new password hashes.
 BCRYPT_COST=12
 
 # --- PATHS ---