No minimum password length, and say how to reset it

The script refused anything under ten characters. That is a policy the owner
should hold, not one the tooling invents; the only rule left is that the password
cannot be empty, since an empty one would let anyone in. Resetting is the same
script with --force, which overwrites the hash and generates a fresh session
secret, signing out anyone who was signed in - now written down in the operating
notes and the deployment readme, including the form that prompts on your own
machine instead of the server.

ansible/readme.md

@@ -68,7 +68,8 @@ publish something.
 
 The app starts with the admin disabled while `/var/lib/menu.<site>/site.env`
 is missing, and the playbook says so rather than failing. Create it once per
-Site:
+Site; run it again with `--force` to reset the password (a fresh session secret
+signs everyone out). There is no minimum password length.
 
 ```sh
 scp scripts/provision-site-env.sh monoco:/tmp/

docs/operating.md

@@ -25,11 +25,28 @@ Preview to check it, then Publish. Publishing archives whatever was current.
 **Put an older menu back.** Open the Section's "older menus" fold in the admin,
 open the set you want and press "Make current". Its URL does not change.
 
-**Change the admin password.** On the server:
+**Change or reset the admin password.** Run the provision script again with
+`--force`: it overwrites the password hash, and generates a fresh session secret,
+which signs out anyone who was signed in. Nothing else changes.
 
 ```sh
-bash /tmp/provision-site-env.sh /var/lib/menu.hopsngrains.com --force
+ssh -t monoco bash /tmp/provision-site-env.sh /var/lib/menu.hopsngrains.com --force
-docker restart menu-app.hopsngrains.com
+ssh monoco docker restart menu-app.hopsngrains.com
+```
+
+There is no minimum length and no password policy — the one rule is that the
+password cannot be empty. It can also be set from a machine that has this repo
+checked out, with the prompt on that machine rather than the server:
+
+```sh
+cd ~/programming/static-menu/menu-admin
+read -r -s -p 'Admin password: ' PW; echo
+HASH=$(printf '%s' "$PW" | node -e "let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',c=>s+=c).on('end',async()=>{const m=await import('./src/auth.ts');process.stdout.write(await m.hashPassword(s))})")
+SECRET=$(node -e "process.stdout.write(require('node:crypto').randomBytes(32).toString('base64url'))")
+printf 'ADMIN_PASSWORD_HASH=%s
+SESSION_SECRET=%s
+' "$HASH" "$SECRET" | ssh monoco "docker run --rm -i --user 1000:1000 -v /var/lib/menu.hopsngrains.com:/data --entrypoint sh registry.tanshu.com/menu-admin:2026-09-22 -c 'umask 077 && cat > /data/site.env'"
+ssh monoco docker restart menu-app.hopsngrains.com
 ```
 
 **Add, rename, reorder or remove a category.** In the admin, open the
@@ -123,11 +140,28 @@ Preview to check it, then Publish. Publishing archives whatever was current.
 **Put an older menu back.** Open the Section's "older menus" fold in the admin,
 open the set you want and press "Make current". Its URL does not change.
 
-**Change the admin password.** On the server:
+**Change or reset the admin password.** Run the provision script again with
+`--force`: it overwrites the password hash, and generates a fresh session secret,
+which signs out anyone who was signed in. Nothing else changes.
 
 ```sh
-bash /tmp/provision-site-env.sh /var/lib/menu.hopsngrains.com --force
+ssh -t monoco bash /tmp/provision-site-env.sh /var/lib/menu.hopsngrains.com --force
-docker restart menu-app.hopsngrains.com
+ssh monoco docker restart menu-app.hopsngrains.com
+```
+
+There is no minimum length and no password policy — the one rule is that the
+password cannot be empty. It can also be set from a machine that has this repo
+checked out, with the prompt on that machine rather than the server:
+
+```sh
+cd ~/programming/static-menu/menu-admin
+read -r -s -p 'Admin password: ' PW; echo
+HASH=$(printf '%s' "$PW" | node -e "let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',c=>s+=c).on('end',async()=>{const m=await import('./src/auth.ts');process.stdout.write(await m.hashPassword(s))})")
+SECRET=$(node -e "process.stdout.write(require('node:crypto').randomBytes(32).toString('base64url'))")
+printf 'ADMIN_PASSWORD_HASH=%s
+SESSION_SECRET=%s
+' "$HASH" "$SECRET" | ssh monoco "docker run --rm -i --user 1000:1000 -v /var/lib/menu.hopsngrains.com:/data --entrypoint sh registry.tanshu.com/menu-admin:2026-09-22 -c 'umask 077 && cat > /data/site.env'"
+ssh monoco docker restart menu-app.hopsngrains.com
 ```
 
 **Add, rename, reorder or remove a category.** In the admin, open the

scripts/provision-site-env.sh

@@ -95,10 +95,6 @@ if [[ "$PASSWORD" != "$REPEAT" ]]; then
   echo "the passwords do not match" >&2
   exit 1
 fi
-if [[ ${#PASSWORD} -lt 10 ]]; then
-  echo "use at least 10 characters" >&2
-  exit 1
-fi
 
 HASH="$(printf '%s' "$PASSWORD" | docker run --rm -i --entrypoint node "$IMAGE" \
   --input-type=module \