Fix: manage panel auth lockout (#12)

Fixed

• Fresh Docker installs locked behind password prompt with no password to enter
• Removed Sec-Fetch-Site header dependency from all auth decisions
• Token generation and password removal errors now show user-facing messages

Changed

• Auth accepts password or API token as Bearer on all requests (no header sniffing)
• API token requires a password to be set first
• Password cannot be removed while an API token is active

Upgrade

docker pull epheterson/zimi:latest and restart your container.

Or pip install --upgrade zimi for Python installs.