fix(installer): do not demand a password the installer already holds

Asked why the password box does not pre-fill from .dbpass. It should not - but
it should not have been demanding a password either.

.dbpass is the ACL'd handoff stage 0 writes when it creates the database itself,
and stage 2 already reads it automatically when no password is supplied. The
wizard, though, required a password whenever .env was absent, without checking
for the handoff. On a server where stage 0 had completed but stage 2 had not -
which is exactly what a partly-failed install leaves - the operator was blocked
on a secret the installer already had, and sent hunting for a generated password
they were never meant to handle.

Blank is now accepted when either .env or .dbpass is present, and the sign-in
page says so when it sees a handoff.

Deliberately NOT pre-filled into the password box, for two reasons. It is the
only copy of a generated password, so round-tripping it through a UI control and
back out through a temporary password file adds exposure for no benefit - stage 2
reads the file directly. And .dbpass belongs to the BUNDLED database; on the
existing-database page the operator is pointing at someone else's server, where
a locally generated password is simply the wrong answer.

deploy/windows/installer/ShopDBFlask.iss

@@ -885,8 +885,15 @@ begin
         MsgBox('Enter the username the application connects with.', mbError, MB_OK);
         Result := False;
       end
+      // Blank is allowed when the password is already ON DISK in a form the
+      // installer can read: .env from a previous install, or the ACL'd .dbpass
+      // handoff stage 0 leaves when it created the database itself. Stage 2
+      // consumes .dbpass on its own, so demanding the password here blocked the
+      // operator on something the installer already had - and sent them looking
+      // for a generated secret they were never meant to handle.
       else if (DbCredsPage.Values[1] = '') and
-              (not FileExists(InstalledDir + '.env')) then
+              (not FileExists(InstalledDir + '.env')) and
+              (not FileExists(InstalledDir + '.dbpass')) then
       begin
         // Only required on a FRESH install. On an upgrade, blank means "keep the
         // password already in .env", so the operator never has to know it.
@@ -933,6 +940,13 @@ begin
   if (CurPageID = DbDetailsPage.ID) and (not DbPageReady) then
   begin
     DbPageReady := True;
+    // A stage-0 handoff means the database was created by a previous run of this
+    // installer and the password is already on disk. Nobody should be asked to
+    // find or retype a secret the installer generated.
+    if FileExists(InstalledDir + '.dbpass') then
+      DbCredsPage.SubCaptionLabel.Caption :=
+        'This server already has a database created by this installer. Leave the '
+        + 'password blank and it will be used automatically.';
     if LoadStringsFromFile(InstalledDir + '.env', Lines) then
       for I := 0 to GetArrayLength(Lines) - 1 do
         if Pos('DATABASE_URL=', Lines[I]) = 1 then