docs(followups): log legacy plaintext admin_config decrypt concern

docs/superpowers/followups.md

@@ -5,6 +5,7 @@ Items surfaced during review of one plan that belong to a later plan. Prevents s
 ## Deferred to Plan 4 (Container + Coolify deploy)
 
 - **Forwarded-headers + Secure-cookie behind Traefik.** Cookie auth in Task 5 uses the ASP.NET Core default `CookieSecurePolicy.SameAsRequest`. Behind Coolify/Traefik TLS termination the app sees plain HTTP internally, so the cookie will silently be sent WITHOUT the `Secure` flag in production unless `UseForwardedHeaders` (with `ForwardedHeaders.XForwardedProto`) is added and TLS-terminating proxies are configured as `KnownProxies`/`KnownNetworks`. Wire this up when we add the Dockerfile + compose in Plan 4.
+- **Boot-time re-seed on legacy plaintext `admin.password_hash_source`.** Plan 2 Task 5 turned `admin.password_hash_source` into a secure key (AES-GCM encrypted at rest). Any DB that predates that commit stores it as plaintext, so on first boot `AdminBootstrap.Seed` → `repo.Get(PasswordSourceKey)` will try to decrypt a plaintext string and throw `CryptographicException`. For pre-launch this is fine (fresh volumes), but before Coolify goes live we should catch that specific exception in `AdminBootstrap.Seed` and treat the row as "not set" so it re-seeds cleanly on the new format.
 
 ## Deferred to Plan 2 (Executor + real nodes)