fix(Docker): require persistent DATA_DIR volume; add VOLUME + README data-persistence warning

Root cause of re-login failing after first-run setup: on EasyPanel/w/o a volume, the
container's /app/backend/data (users, incl. the changed admin password) is wiped on every
recreate, so logging back in with the new password fails. Added:
- ENV DATA_DIR=/app/backend/data (explicit) + VOLUME declaration in Dockerfile
- README 'Data persistence' section: must mount a persistent volume to /app/backend/data

Verified: backend + live server login>setup>relogin-with-new-password works (200); the
failure is deployment data persistence, not login logic.

Dockerfile

@@ -28,6 +28,12 @@ COPY backend/ ./backend/
 
 # Run
 WORKDIR /app/backend
+# Explicit data dir so operators mount a persistent volume here.
+# Without a volume, ALL user data (incl. the admin password change from first-run
+# setup) is lost on every container recreate -> re-login with the new password fails.
+# Persist with:  docker run -v ./data:/app/backend/data  (or compose ./data)
+ENV DATA_DIR=/app/backend/data
 ENV FLASK_DEBUG=0
 EXPOSE 5001
+VOLUME ["/app/backend/data"]
 CMD ["python", "run.py"]

README.md

@@ -118,3 +118,14 @@ Real-model verification requires a live `LLM_API_KEY` in `.env`.
 | super_admin | `admin` | `1234` (forced to set email + change on first login) |
 
 Admins create additional users (users/login has no self-registration).
+
+## ⚠️ Data persistence (IMPORTANT)
+All data (users, passwords, groups, sessions) lives in `DATA_DIR` (default `/app/backend/data`).
+**This directory MUST be a persistent volume in production.** If the container restarts/recreates
+without a volume, all data is wiped — including the admin password you changed on first login, so
+you will not be able to log back in with your new password.
+
+- Docker run: `-v ./data:/app/backend/data`
+- Docker Compose: already mounts `./data:/app/backend/data` (see `docker-compose.yml`)
+- EasyPanel / other platforms: **mount a persistent volume to `/app/backend/data`** (or point
+  `DATA_DIR` at a mounted path), otherwise user data resets on every deploy.