fix: remove debug logging from login route; fix .env.example formatting

- Remove console.log debug lines added during password troubleshooting
- .env.example: restore correct formatting, add note about $ escaping with
  single quotes + backslashes for bcrypt hashes

.env.example

@@ -1,13 +1,18 @@
 # Copy this to .env and fill in values for local development.
 # In production, set these as environment variables / Kubernetes secrets.
+#
+# NOTE: Values containing $ must be quoted with single quotes + backslashes:
+#   PASSWORD_HASH='$2b$12$...'
 
-# Comma-separated list of additional allowed CORS origins.
-# Add your dev machine's IP here if accessing via IP address.
-# e.g. ALLOWED_ORIGINS=http://192.168.0.94:5173
-ALLOWED_ORIGINS=
+# bcrypt hash of the admin password. Generate with:
 #   python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpassword', bcrypt.gensalt(rounds=12)).decode())"
 PASSWORD_HASH=
 
 # Random secret for signing session tokens. Generate with:
 #   openssl rand -hex 32
 SESSION_SECRET=
+
+# Comma-separated list of additional allowed origins for CSRF.
+# Add your dev machine's IP here if accessing via IP address.
+# e.g. ALLOWED_ORIGINS=http://192.168.0.94:5173
+ALLOWED_ORIGINS=