Fold email columns into init.sql, drop the admin/admin demo mention

Fresh installs (docker compose up -d --build, exactly what the README
tells a new self-hoster to run) never got the email/must_set_email/
self_registered_at columns added in migration 006 - only init.sql runs
automatically, migrations always need a manual step, and this one
never got folded into the base schema. A genuine first-time clone
would have broken immediately on login. Verified with a real fresh
volume: seed superadmin now correctly walks through forced password
change -> forced email set -> dashboard, no manual migration needed.

Also: qr.ensembia.com's README/About text still pointed at the
shared admin/admin demo login - replaced with a link to register.php
now that self-registration is live (the shared account has been
removed from the live instance).

README.md

@@ -8,8 +8,8 @@ of the original [PHP Dynamic Qr code](https://github.com/giandonatoinverso/PHP-D
 project by Giandonato Inverso, built on [AdminLTE](https://adminlte.io/).
 
 - **Try it free:** [qr.ensembia.com](https://qr.ensembia.com) - fully functional OSS test
-  instance. Self-service signup isn't live yet, so log in with the temporary shared demo
-  account `admin` / `admin` in the meantime.
+  instance. [Register your own free account](https://qr.ensembia.com/register.php)
+  (email + a self-hosted CAPTCHA, no third-party service) - no shared demo login needed.
 - **Commercial VIP edition:** the ability to give sub-users the ability to create
   QR codes as well, from their own (sub)account. If you have a bigger organisation,
   having more users being able to create new QR codes delegates your workload. To

db/init.sql

@@ -19,14 +19,20 @@ CREATE TABLE IF NOT EXISTS `users` (
   `can_view_static` tinyint(1) NOT NULL DEFAULT 0,
   `can_view_dynamic` tinyint(1) NOT NULL DEFAULT 0,
   `owner_admin_id` int(25) DEFAULT NULL,
+  `email` varchar(255) DEFAULT NULL,
+  `must_set_email` tinyint(1) NOT NULL DEFAULT 0,
+  `self_registered_at` datetime DEFAULT NULL,
   PRIMARY KEY (`id`),
-  UNIQUE KEY `username` (`username`)
+  UNIQUE KEY `username` (`username`),
+  UNIQUE KEY `email` (`email`)
 ) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=0 ;
 
 -- Default super admin account. Credentials: superadmin / superadmin
 -- must_change_password=1 forces a password change on first login (see Fase 1 hardening).
-INSERT INTO `users` (`id`, `username`, `password`, `series_id`, `remember_token`, `expires`, `type`, `must_change_password`, `password_changed_at`) VALUES
-(1, 'superadmin', '$2y$10$xpZc5KC.aU2XHkcqhuZGFuAnqmtL4Unt8MysOyylceq.19XIyoZpG', NULL, NULL, NULL, 'super', 1, NULL);
+-- must_set_email=1: no email yet, so login falls back to username until it's set (same
+-- one-time interstitial pre-migration accounts get - see set_email.php).
+INSERT INTO `users` (`id`, `username`, `password`, `series_id`, `remember_token`, `expires`, `type`, `must_change_password`, `password_changed_at`, `must_set_email`) VALUES
+(1, 'superadmin', '$2y$10$xpZc5KC.aU2XHkcqhuZGFuAnqmtL4Unt8MysOyylceq.19XIyoZpG', NULL, NULL, NULL, 'super', 1, NULL, 1);
 
 CREATE TABLE IF NOT EXISTS `dynamic_qrcodes` (
   `id` int(10) NOT NULL AUTO_INCREMENT,

src/about.php

@@ -51,8 +51,9 @@ require_once BASE_PATH . '/includes/auth_validate.php';
                         This is the free, open-source (MIT) edition of QRForge. It runs unmodified
                         as a live, fully functional try-out at
                         <a href="https://qr.ensembia.com" target="_blank">qr.ensembia.com</a> -
-                        self-service signup isn't live yet, so log in with the temporary shared
-                        demo account <code>admin</code> / <code>admin</code> in the meantime.
+                        <a href="https://qr.ensembia.com/register.php" target="_blank">register your
+                        own free account</a> there (email + a self-hosted CAPTCHA, no third-party
+                        service).
                     </p>
                     <p>
                         The commercial VIP edition (paid create-rights and logo-embedded QR codes)