feat(users): bootstrap first admin on startup

BOOTSTRAP_ADMIN_EMAIL/PASSWORD seed a role=admin account at boot if absent —
the only way to get the first admin, since /register makes plain users and
promotion needs an existing admin. Idempotent and race-safe. Tests included.

users/cmd/userservice/main.go

@@ -60,6 +60,18 @@ func run() error {
 		Users:       users,
 	}
 
+	// Seed the first admin, if configured. Idempotent: a no-op once it exists.
+	if cfg.BootstrapAdminEmail != "" && cfg.BootstrapAdminPassword != "" {
+		created, err := usecase.NewBootstrapAdmin(users, hasher, clock).
+			Execute(ctx, cfg.BootstrapAdminEmail, cfg.BootstrapAdminPassword)
+		if err != nil {
+			return fmt.Errorf("bootstrap admin: %w", err)
+		}
+		if created {
+			log.Info("bootstrap admin created", "email", cfg.BootstrapAdminEmail)
+		}
+	}
+
 	handler := apihttp.NewServer(log, uc, issuer)
 	// A blanket per-request deadline: bcrypt is bounded, so anything slower is a
 	// stuck handler we want to shed rather than hold a connection open.