update

docs/deployment.md

@@ -94,12 +94,14 @@ the repository or at an absolute host path.
 Create the initial Gitea administrator:
 
 ```sh
-docker compose exec gitea \
-  gitea admin user create \
-  --admin --username taiadmin --email ADMIN-EMAIL \
-  --password 'TEMPORARY-RANDOM-PASSWORD' --must-change-password
+./manage.sh create-admin
 ```
 
+No Gitea login is hard-coded or stored in `.env`. The command prompts for the
+administrator username and email, generates a temporary password, and requires
+it to be changed at first login. The initial web installer is intentionally
+locked and public registration is disabled.
+
 Sign in to Gitea at `https://GITEA_DOMAIN`, create the `TAI` organization, and
 create: