feat: add bootstrap admin auth docs and fix config loading

- Document bootstrap admin login via KMTN_ADMIN_USERNAME/PASSWORD
  env vars, including setup guide, curl examples, and config table
  entries across docker-compose and bare-metal deployment sections
- Add KMTN_JWT_SECRET_KEY to all deployment config examples and
  production checklist
- Fix docker-entrypoint.sh: remove unused API_UPSTREAM variable from
  config.json envsubst (only API_PUBLIC_URL is needed)
- Fix app-config.service: default apiBaseUrl now reads from Angular
  environment instead of empty string, and config.json path drops
  leading ./ for cleaner resolution

src/app/services/app-config.service.ts

@@ -2,22 +2,24 @@ import { HttpClient } from '@angular/common/http';
 import { APP_INITIALIZER, InjectionToken } from '@angular/core';
 import { lastValueFrom } from 'rxjs';
 
+import { environment } from '../../environments/environment';
+
 export interface AppConfig {
   apiBaseUrl: string;
 }
 
 export const APP_CONFIG = new InjectionToken<AppConfig>('appConfig');
 
+// Default to the Angular environment value (http://localhost:8000 in dev, '' in prod).
+// A runtime config.json can override this in production.
 const _appConfig: AppConfig = {
-  apiBaseUrl: '',
+  apiBaseUrl: environment.apiBaseUrl,
 };
 
 export function appConfigFactory(http: HttpClient) {
   return (): Promise<void> => {
-    return lastValueFrom(http.get<AppConfig>('./config.json')).then(
-      (config) => {
-        Object.assign(_appConfig, config);
-      },
+    return lastValueFrom(http.get<AppConfig>('config.json')).then(
+      (config) => { Object.assign(_appConfig, config); },
       () => {
         // Keep defaults if config.json is not available (dev mode).
       },