fix: use WEB_PASSWORD for admin API auth (admin_password takes priority over api_key)

fix: prioritize API_KEY env var for import auth

fix: correct API path for account import (/api/accounts)

feat: add accounts_export.json auto-import from Supabase