feat(install): per-host auto-generated secrets for Docker installs

Each fresh 1Panel/Docker install generates unique MYSQL and NEXUS keys
via scripts/generate_nexus_secrets.py; install wizard reuses compose env.

docker/.env.prod.example

@@ -1,14 +1,18 @@
 # Production Compose env — copy to docker/.env.prod (never commit)
-# Migrate NEXUS_* secrets from Baota /www/wwwroot/.../.env UNCHANGED.
+# Fresh install: bash deploy/install-nexus-fresh.sh (auto-generates unique secrets per host)
+# Migration: bash deploy/nexus-1panel.sh install --from-env /path/to/old/.env
 
 MYSQL_ROOT_PASSWORD=change_me_root_strong
 MYSQL_PASSWORD=change_me_nexus_strong
 
-# Required — copy from production .env (do NOT regenerate)
+# Auto-generated on fresh install (unique per server). Do NOT copy between hosts.
 NEXUS_SECRET_KEY=
 NEXUS_API_KEY=
 NEXUS_ENCRYPTION_KEY=
 
+# 1 = entrypoint must not write /app/.env until install wizard step 3
+NEXUS_INSTALL_WIZARD_PENDING=0
+
 # Public URL
 NEXUS_CORS_ORIGINS=https://api.synaglobal.vip
 NEXUS_API_BASE_URL=https://api.synaglobal.vip