cli: avoid data-dir initialization for version; create db parent dirs; redact generated passwords in CLI output

- Prevent 'nx9-wg version' from creating data directories by avoiding database initialization.
- Create parent directories when an explicit --database path is provided.
- Redact printed generated administrator passwords; announce file path or redact instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Dockerfile

@@ -0,0 +1,44 @@
+# ==============================================================================
+# NX9 WireGuard - Multi-Stage Container Image
+# ==============================================================================
+
+# ── Stage 1: Build binary in Rust environment ────────────────────────────────
+FROM rust:1.97-bookworm AS builder
+
+WORKDIR /usr/src/nx9-wg
+
+# Copy manifests and source tree
+COPY Cargo.toml Cargo.lock ./
+COPY crates ./crates
+COPY src ./src
+
+# Build release binary with optimization
+RUN cargo build --release --bin nx9-wg
+
+# ── Stage 2: Minimal runtime image ──────────────────────────────────────────
+FROM debian:bookworm-slim
+
+# Install only essential runtime dependencies (ca-certificates for HTTPS/TLS)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy compiled binary from builder
+COPY --from=builder /usr/src/nx9-wg/target/release/nx9-wg /usr/local/bin/nx9-wg
+
+# Create state and configuration directories
+RUN mkdir -p /var/lib/nx9-wg /etc/nx9-wg /var/lib/nx9-wg/backups
+
+# Expose API/WebSocket port and default WireGuard UDP listen port
+EXPOSE 8080 51820/udp
+
+# Environment defaults
+ENV NX9_WG_DATA_DIR=/var/lib/nx9-wg
+ENV NX9_WG_LOG_LEVEL=info
+
+# Healthcheck against Axum public health endpoint
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+    CMD ["/usr/local/bin/nx9-wg", "system", "health"] || exit 1
+
+ENTRYPOINT ["/usr/local/bin/nx9-wg"]
+CMD ["serve", "--bind", "0.0.0.0:8080"]