database.php set $ACCESS_PWD to the boolean result of defined('DB_ACCESS_ENABLED'),
so the configured DB_ACCESS_PWD was never used as the phpMiniAdmin password. Source
it from the DB_ACCESS_PWD constant instead.
AppConfig ships safe defaults: DB_ACCESS_ENABLED=false and an empty DB_ACCESS_PWD
(a repo-committed password is public and protects nothing) — admins opt in and set
a strong password per install. Access stays behind the admin session + is_admin;
an empty password admits only local IPs.