feat: автосоздавать .env из .env.example при первом запуске

Раньше при отсутствии .env docker compose тихо стартовал на дефолтах
из docker-compose.yml (без пароля, дефолтные креды Postgres), никак
не сигнализируя об этом. Добавлен start.sh — обёртка над
docker compose up -d --build, которая при отсутствии .env создаёт его
из .env.example и один раз громко предупреждает об используемых
дефолтах перед стартом контейнеров. README обновлён на использование
этого скрипта.

README.md

@@ -129,11 +129,13 @@ Everything else in `.env` (currency, CORS, the port Aurum listens on) has a sens
 ### 4. Start it
 
 ```bash
-docker compose up -d --build
+./start.sh
 ```
 
 This builds the backend and frontend images, starts Postgres, waits for it to report healthy, then starts the backend (which runs every database migration automatically — nothing to do by hand) and finally the frontend. First run takes a minute or two; after that, images are cached and it's seconds.
 
+`start.sh` is a thin wrapper around `docker compose up -d --build` — if you skipped step 3 and there's no `.env` yet, it creates one from `.env.example` and prints a warning about the defaults it's running on (no password, default Postgres credentials) before starting anything, instead of silently starting an unprotected instance. You can still run `docker compose up -d --build` directly if you prefer; just make sure `.env` exists first.
+
 ### 5. Open it
 
 Visit **http://localhost:3000** (or whatever port you set via `AURUM_WEB_PORT` in `.env`). A default account and the standard expense/income categories are seeded automatically — there's nothing to configure before you can add your first transaction.

start.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Thin wrapper around `docker compose up` that guarantees a .env file
+# exists before containers start. Running `docker compose up --build`
+# directly works fine even without .env — every variable in
+# docker-compose.yml and backend/app/core/config.py has a hardcoded
+# fallback — but that means someone who skips the README's "cp
+# .env.example .env" step gets a fully working instance with no visible
+# sign that it's running on defaults (weak Postgres password, no basic
+# auth — see frontend/docker-entrypoint.d/20-basic-auth.sh) until they
+# go looking for it. This script closes that gap: if .env is missing,
+# it's created from .env.example and the operator is told, loudly, once,
+# before anything starts — rather than staying silent forever.
+set -eu
+
+cd "$(dirname "$0")"
+
+if [ ! -f .env ]; then
+  cp .env.example .env
+  cat >&2 <<'EOF'
+[aurum] No .env file found — created one from .env.example with default values:
+[aurum]   - No password on the app itself (AURUM_BASIC_AUTH_USER/PASSWORD blank)
+[aurum]   - Default Postgres credentials (AURUM_POSTGRES_PASSWORD=change-me)
+[aurum] Fine for a quick local try-out on localhost. Before exposing this beyond
+[aurum] your own machine, edit .env and re-run this script (or `docker compose up -d --build`).
+EOF
+fi
+
+exec docker compose up -d --build "$@"