fix: avoid GHCR 403 in default installer

scripts/update.sh

@@ -14,6 +14,19 @@ fi
 ensure_compose_v2 || exit 1
 COMPOSE=(docker compose)
 
+if [[ "${USE_GHCR:-0}" != "1" ]]; then
+  echo "Этот update.sh относится к legacy GHCR-режиму и может дать 403 Forbidden."
+  echo "Для source-установки обновляйтесь из панели или вручную:"
+  echo "  cd /opt/amnezia-web-pro"
+  echo "  git pull"
+  echo "  docker compose build"
+  echo "  docker compose up -d"
+  echo ""
+  echo "Если точно нужен старый GHCR-режим, запустите:"
+  echo "  USE_GHCR=1 sudo -E bash scripts/update.sh"
+  exit 1
+fi
+
 set -a
 # shellcheck disable=SC1090
 source "${ENV_FILE}"
@@ -28,9 +41,29 @@ trim_crlf() {
 }
 GHCR_USERNAME="$(trim_crlf "${GHCR_USERNAME:-}")"
 GHCR_TOKEN="$(trim_crlf "${GHCR_TOKEN:-}")"
+ADMIN_PASSWORD="$(trim_crlf "${ADMIN_PASSWORD:-}")"
 
 printf '%s\n' "${GHCR_TOKEN}" | docker login ghcr.io -u "${GHCR_USERNAME}" --password-stdin
 "${COMPOSE[@]}" -f "${COMPOSE_FILE}" --env-file "${ENV_FILE}" pull
-"${COMPOSE[@]}" -f "${COMPOSE_FILE}" --env-file "${ENV_FILE}" up -d
+
+RESET_PANEL_PASSWORD=0
+if [[ -n "${ADMIN_PASSWORD}" ]]; then
+  echo "→ ADMIN_PASSWORD задан — сбрасываю старый пароль панели в volume."
+  "${COMPOSE[@]}" -f "${COMPOSE_FILE}" --env-file "${ENV_FILE}" run --rm --no-deps --entrypoint sh panel -lc '
+    set -eu
+    if [ -f /data/password.hash ]; then
+      cp -p /data/password.hash "/data/password.hash.bak.$(date -u +%Y%m%dT%H%M%SZ)" 2>/dev/null || true
+      rm -f /data/password.hash
+      rm -f /data/session.secret
+    fi
+  '
+  RESET_PANEL_PASSWORD=1
+fi
+
+UP_ARGS=(up -d)
+if [[ "${RESET_PANEL_PASSWORD}" == "1" ]]; then
+  UP_ARGS+=(--force-recreate)
+fi
+"${COMPOSE[@]}" -f "${COMPOSE_FILE}" --env-file "${ENV_FILE}" "${UP_ARGS[@]}"
 
 echo "Обновлено."