feat(users): bootstrap first admin on startup

BOOTSTRAP_ADMIN_EMAIL/PASSWORD seed a role=admin account at boot if absent —
the only way to get the first admin, since /register makes plain users and
promotion needs an existing admin. Idempotent and race-safe. Tests included.

users/.env.example

@@ -11,6 +11,12 @@ JWT_TTL=24h
 # bcrypt work factor. Empty/0 uses the library default (10).
 # BCRYPT_COST=10
 
+# First-admin bootstrap. When both are set and no such account exists, the
+# service creates it with role=admin on startup (idempotent). This is the only
+# way to get the first admin. Leave empty in production once seeded.
+# BOOTSTRAP_ADMIN_EMAIL=root@scimesh.local
+# BOOTSTRAP_ADMIN_PASSWORD=change-me-strong
+
 # Logging. LOG_LEVEL: debug|info|warn|error. LOG_FILE empty = stdout only;
 # set a path to also write a size-rotated file (kept across restarts).
 LOG_LEVEL=info