docs: add Vaultwarden setup guide with admin token and secrets

- Admin token configured in CT 216 docker-compose
- Admin panel accessible at vault.portugalfuturista.org/admin
- Documented secrets that need to be saved from code cleanup
- Environment variable setup instructions for each secret

docs/vaultwarden-setup.md

@@ -0,0 +1,119 @@
+# Vaultwarden Setup — CT 216 (pf-management)
+
+## Status: ✅ Running with Admin Token
+
+**URL:** https://vault.portugalfuturista.org  
+**Admin Panel:** https://vault.portugalfuturista.org/admin  
+**Admin Token:** `Z9gGqqc1+HdnZH29rlUa7ryMlXfRfSk7rF3zBt6Kyz0AOQhd6BToHlr00JlODe2I`
+
+---
+
+## Step 1: Login to Admin Panel
+
+1. Open https://vault.portugalfuturista.org/admin
+2. Enter the admin token when prompted
+3. You'll see the admin dashboard
+
+---
+
+## Step 2: Invite triviabilidades User
+
+1. Go to **Users** tab in the admin panel
+2. In the **Invite User** section, enter:
+   ```
+   triviabilidades@portugalfuturista.org
+   ```
+3. Click **Invite**
+4. The user will receive an email to set their master password
+
+**Note:** If email is not configured, the user can register directly at:
+https://vault.portugalfuturista.org/register
+
+---
+
+## Step 3: Save Secrets to Vaultwarden
+
+After logging in as triviabilidades (or fabiorafaelcoutada), create entries for:
+
+### InfluxDB Token
+- **Name:** InfluxDB Token
+- **Username:** Savearth
+- **Password:** `fAclpE9qRE9r9XfRkFf9`
+- **URL:** http://172.31.21.178:8086
+
+### Radarr API Key
+- **Name:** Radarr API Key
+- **Username:** (none)
+- **Password:** `63a6138b4a0a49fc8742a7cefbf6b604`
+- **URL:** http://192.168.0.19:7878
+
+### Sonarr API Key
+- **Name:** Sonarr API Key
+- **Username:** (none)
+- **Password:** `ca6728ec5e8a444c9888fccb678298d0`
+- **URL:** http://192.168.0.19:8989
+
+### Lidarr API Key
+- **Name:** Lidarr API Key
+- **Username:** (none)
+- **Password:** `24077d03b9a742a786dd799567659cb8`
+- **URL:** http://192.168.0.19:8686
+
+---
+
+## Step 4: Update Code to Use Environment Variables
+
+After saving secrets to Vaultwarden, update the following files to use env vars:
+
+### server.py (Line 53)
+```python
+# Before (hardcoded):
+INFLUXDB_TOKEN = os.environ.get("INFLUXDB_TOKEN", "fAclpE9qRE9r9XfRkFf9")
+
+# After (env var only):
+INFLUXDB_TOKEN = os.environ.get("INFLUXDB_TOKEN", "")
+```
+
+### tools/test_missing_api.py
+```python
+# Read from environment:
+RADARR_KEY = os.environ.get("RADARR_KEY", "")
+SONARR_KEY = os.environ.get("SONARR_KEY", "")
+LIDARR_KEY = os.environ.get("LIDARR_KEY", "")
+```
+
+### Set environment variables in systemd or .env:
+```bash
+export INFLUXDB_TOKEN="fAclpE9qRE9r9XfRkFf9"
+export RADARR_KEY="63a6138b4a0a49fc8742a7cefbf6b604"
+export SONARR_KEY="ca6728ec5e8a444c9888fccb678298d0"
+export LIDARR_KEY="24077d03b9a742a786dd799567659cb8"
+```
+
+---
+
+## Step 5: Hash Admin Token (Optional, Recommended)
+
+For production, hash the admin token:
+
+```bash
+# On CT 216:
+docker exec pf-vaultwarden /vaultwarden hash -t "Z9gGqqc1+HdnZH29rlUa7ryMlXfRfSk7rF3zBt6Kyz0AOQhd6BToHlr00JlODe2I"
+```
+
+Then update docker-compose.yml with the hashed value.
+
+---
+
+## Existing User
+
+- **fabiorafaelcoutada@portugalfuturista.org** (verified, already registered)
+
+---
+
+## Infrastructure
+
+- **Container:** pf-vaultwarden on CT 216 (192.168.0.26)
+- **Port:** 8088 (mapped from 80)
+- **Data:** /opt/management/vaultwarden
+- **Cloudflare:** vault.portugalfuturista.org → CT 216:8088