This install has no accounts yet. The first account created is the owner and can do everything: manage providers and encrypted keys, configure routing, set budgets, add users and rotate the encryption key.
The password is stored only as an Argon2id hash. Provider secrets are encrypted separately with AES-256-GCM under a key that never leaves the server.