docs: add admin password-reset recipe; gitignore local secret notes

- README maintenance: reset admin password via UI or 'forgejo admin
  user change-password' (no email/old password needed)
- .gitignore: secrets.local.md + *.local.secret so off-git credential
  backups can never be committed

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,3 +1,7 @@
 # Forgejo runner registration file — contains a secret, never commit.
 runner/.runner
 *.env
+
+# Local secret notes — backup of credentials kept off git. NEVER commit.
+secrets.local.md
+*.local.secret

README.md

@@ -204,4 +204,11 @@ No changes to this repo. In the new project:
   cert and risks Let's Encrypt rate limits.
 - **Least privilege:** restrict the deploy key in `authorized_keys` with a
   forced `command=` that only runs the compose pull/up script.
+- **Reset the admin password** (no email/old password needed): as an admin via
+  *Site Administration → User Accounts → (user) → Password*, or from the VPS:
+  ```sh
+  docker compose exec -u git forgejo \
+    forgejo admin user change-password --username <user> \
+    --password 'NEW' --must-change-password=false
+  ```
 ```