refactor(auth): remove obsolete CONVERT_PASSWORDS env var

Legacy md5/argon2id hashes are now always upgraded to bcrypt on login, so
the CONVERT_PASSWORDS flag is no longer used. Drop it from env schema,
.env.example, the docker installer, and test mocks.

src/actions/auth-precheck.test.ts

@@ -17,7 +17,7 @@ const core = vi.hoisted(() => ({
 	}),
 }));
 
-vi.mock("@/env", () => ({ env: { CONVERT_PASSWORDS: false } }));
+vi.mock("@/env", () => ({ env: {} }));
 vi.mock("@/lib/auth/login-core", () => core);
 vi.mock("@/lib/rate-limit", () => ({ clientIp: vi.fn(), rateLimit: vi.fn() }));
 vi.mock("@/lib/services/captcha", () => ({

src/env.ts

@@ -69,12 +69,6 @@ const schema = z
 		// Laravel APP_KEY (base64:...) — needed to read existing 2FA secrets.
 		APP_KEY: z.string().optional(),
 
-		// Deprecated: legacy md5/argon2id hashes are ALWAYS upgraded to bcrypt
-		// on login now (no flag required). Kept for config compatibility.
-		CONVERT_PASSWORDS: z
-			.string()
-			.optional()
-			.transform((v) => v === "true" || v === "1"),
 		// bcrypt cost factor used for new password hashes.
 		BCRYPT_COST: z.coerce.number().int().min(4).max(31).default(12),
 		// Filesystem dir the badge uploader writes <code>.gif into (the emulator's

src/lib/auth/password.test.ts

@@ -138,14 +138,14 @@ describe("isDoubleMd5Of", () => {
 describe("isSaltedMd5Of", () => {
 	it("verifies md5(salt+password) with hash:salt layout", async () => {
 		const salt = "pepper123";
-		const stored = `${(await md5Hex(salt + "oldpass"))}:${salt}`;
+		const stored = `${await md5Hex(salt + "oldpass")}:${salt}`;
 		expect(await isSaltedMd5Of("oldpass", stored)).toBe(true);
 		expect(await isSaltedMd5Of("wrong", stored)).toBe(false);
 	});
 
 	it("verifies md5(password+salt) with hash:salt layout", async () => {
 		const salt = "pepper123";
-		const stored = `${(await md5Hex("oldpass" + salt))}:${salt}`;
+		const stored = `${await md5Hex("oldpass" + salt)}:${salt}`;
 		expect(await isSaltedMd5Of("oldpass", stored)).toBe(true);
 	});
 

src/lib/auth/password.ts

@@ -57,7 +57,10 @@ export async function isDoubleMd5Of(
 	stored: string,
 ): Promise<boolean> {
 	if (!/^[a-f0-9]{32}$/i.test(stored)) return false;
-	return (await md5Hex(await md5Hex(password))).toLowerCase() === stored.toLowerCase();
+	return (
+		(await md5Hex(await md5Hex(password))).toLowerCase() ===
+		stored.toLowerCase()
+	);
 }
 
 /**