fix admin user at production

scripts/docker-prod-common.sh

@@ -425,11 +425,6 @@ ensure_prod_admin() {
   local first_name="${ADMIN_SEED_FIRST_NAME:-Super}"
   local last_name="${ADMIN_SEED_LAST_NAME:-Admin}"
 
-  if [[ ! -t 0 ]]; then
-    echo "Skipping interactive admin setup (stdin is not a TTY)."
-    return 0
-  fi
-
   local admin_exists=0
   echo "Checking admin user ${email}..."
   if prod_compose run --rm \
@@ -439,6 +434,32 @@ ensure_prod_admin() {
     admin_exists=1
   fi
 
+  if [[ ! -t 0 ]]; then
+    if [[ -z "${ADMIN_PASSWORD:-}" ]]; then
+      echo "Skipping admin setup (stdin is not a TTY and ADMIN_PASSWORD is not set)."
+      echo "Set ADMIN_PASSWORD for first-time setup. Set ADMIN_UPDATE_EXISTING=true to rotate an existing admin password." >&2
+      return 0
+    fi
+
+    if [[ ${admin_exists} -eq 1 && "${ADMIN_UPDATE_EXISTING:-false}" != "true" ]]; then
+      echo "Admin user ${email} already exists; keeping existing password."
+      echo "Set ADMIN_UPDATE_EXISTING=true with ADMIN_PASSWORD to rotate it non-interactively." >&2
+      return 0
+    fi
+
+    prod_compose run --rm \
+      -v "${ROOT_DIR}/scripts:/app/scripts:ro" \
+      -e ADMIN_EMAIL="${email}" \
+      -e ADMIN_PASSWORD="${ADMIN_PASSWORD}" \
+      -e ADMIN_FIRST_NAME="${first_name}" \
+      -e ADMIN_LAST_NAME="${last_name}" \
+      -e ADMIN_UPDATE_EXISTING="${ADMIN_UPDATE_EXISTING:-false}" \
+      api node scripts/create-admin-user.cjs
+
+    echo "Admin user ${email} is ready."
+    return 0
+  fi
+
   if [[ ${admin_exists} -eq 1 ]]; then
     echo "Admin user ${email} already exists."
     local update_answer