docs: prefer Docker build pack + build-variable note; log ADMIN_SESSION_SECRET at boot

docs/coolify.md

@@ -60,9 +60,26 @@ Internet
    - **Name:** `spomeniqr`
    - **Repository URL:** your Git repo URL
    - **Branch:** `main`
-   - **Build Pack:** **Nixpacks** (auto-detected) or **Docker** (uses the Dockerfile)
+   - **Build Pack:** **Docker** (recommended) or **Nixpacks**
 
-### Option A: Nixpacks (Recommended — simpler)
+### Option A: Docker (Recommended — uses the project's Dockerfile)
+
+Set **Build Pack** to **Docker**. Coolify will use the `Dockerfile` in the repo root.
+No additional configuration needed — it already includes Prisma generate,
+`next build`, migrations (`prisma migrate deploy`), and automatic super-admin
+provisioning on startup. This is the verified path (tested end-to-end locally).
+
+**Note:** If using the Docker build pack, the `DATABASE_URL` must use
+`spomeniqr-db` as the host (Coolify internal network), not `localhost`.
+
+**Build-time variables:** the `NEXT_PUBLIC_*` env vars are inlined into the
+browser bundle during `next build`. The Dockerfile declares matching `ARG`s, so
+mark every `NEXT_PUBLIC_*` variable as a **build variable** in Coolify (the
+checkbox on each env var). Without this, client-side Clerk auth (sign-in /
+sign-up) will have no publishable key. Server-side middleware also reads them at
+runtime, so keep them set as regular runtime vars too.
+
+### Option B: Nixpacks (auto-detected)
 
 Leave the build pack as **Nixpacks**. Coolify will auto-detect Next.js and build it.
 
@@ -76,11 +93,9 @@ Add this **Start Command:**
 npx prisma migrate deploy && node .next/standalone/server.js
 ```
 
-### Option B: Docker (uses the project's Dockerfile)
-
-Set **Build Pack** to **Docker**. Coolify will use the `Dockerfile` in the repo root. No additional configuration needed — it already includes Prisma migration and standalone server startup.
-
-**Note:** If using Docker build pack, the `DATABASE_URL` must use `spomeniqr-db` as the host (Coolify internal network), not `localhost`.
+**Note:** With a custom start command the auto-seed does not run; provision the
+super-admin manually after the first deploy with `npx prisma db seed` (or see the
+seed note in Step 4).
 
 ## Step 4: Configure Environment Variables
 
@@ -126,6 +141,16 @@ NODE_ENV=production
 - `DATABASE_URL` must point to the Coolify **internal** hostname (`spomeniqr-db`), not `localhost`.
 - Use your **production** Clerk keys (`pk_live_` / `sk_live_`), not the test ones.
 - Use a **different, strong** super-admin password than your local development one.
+- Generate the hash **on your dev machine** (in the project, so it uses the
+  project's `bcryptjs`) and paste it **verbatim** — Coolify passes values
+  literally, no `$$` escaping:
+  ```
+  node -e "import('bcryptjs').then(b => b.default.hash('YOUR_PASSWORD', 12).then(console.log))"
+  ```
+- Mark **every `NEXT_PUBLIC_*` variable as a build variable** (checkbox) so it is
+  inlined into the client bundle at `next build`. Server-only vars
+  (`CLERK_SECRET_KEY`, `DATABASE_URL`, `ADMIN_SESSION_SECRET`,
+  `SUPER_ADMIN_PASSWORD_HASH`, `S3_*`) stay as normal runtime variables.
 - The `super` admin row is provisioned automatically on container start by
   `scripts/start.sh` (`node prisma/seed.cjs` after migrations). If you instead
   use a custom Nixpacks start command (Option A below), run the seed manually

scripts/start.sh

@@ -7,6 +7,7 @@ echo "=== SpomeniQR Starting ==="
 echo "DATABASE_URL: ${DATABASE_URL:+set}"
 echo "CLERK_SECRET_KEY: ${CLERK_SECRET_KEY:+set}"
 echo "S3_ENDPOINT: ${S3_ENDPOINT:+set}"
+echo "ADMIN_SESSION_SECRET: ${ADMIN_SESSION_SECRET:+set}"
 
 echo "Running Prisma migrations..."
 if ! npx prisma migrate deploy; then