feat: kithara-admin CLI tool and .env.example

- kithara-admin: full user/invite management CLI
  - list-users, create-user, delete-user, change-role, reset-password
  - create-invite, list-invites, revoke-invite
  - Uses bcrypt directly (not passlib) for host compatibility
  - Reads data/kithara.db directly for admin operations
- .env.example: documented all config options with defaults
  - KITHARA_MODE, admin credentials, JWT secret, Lyria config
- Fixed docker-compose env vars: KITHARA_ADMIN_USER/PASS (matching auth.py)

.env.example

@@ -0,0 +1,28 @@
+# Kithara Studio Configuration
+# Copy this file to .env and customize
+
+# Google Lyria API key (required)
+LYRIA_API_KEY=your-api-key-here
+
+# Default Lyria model
+LYRIA_DEFAULT_MODEL=lyria-3-clip-preview
+
+# Default ID3 tag values (used when track metadata is empty)
+DEFAULT_ID3_ARTIST=Kagamine Rin
+DEFAULT_ID3_ALBUM=Kithara Studio
+DEFAULT_ID3_GENRE=Hardcore Techno
+
+# Auth mode: single (no login, one user) or multi (full auth with JWT)
+KITHARA_MODE=single
+
+# Bootstrap admin credentials (only used in multi mode on first startup)
+# Creates this admin user automatically if it doesn't exist
+# KITHARA_ADMIN_USER=admin
+# KITHARA_ADMIN_PASS=changeme
+
+# JWT secret (auto-generated if not set, persists in DB)
+# Set this if you want tokens to survive DB resets
+# KITHARA_JWT_SECRET=your-secret-here
+
+# Timezone
+TZ=America/New_York