Add first-run admin setup flow

[henrikogaard]

Summary

Add an explicit first-run admin bootstrap flow so new operators do not depend on implicit first-user promotion.

Why

The current first-user-admin behavior is convenient, but a setup token or first-run screen would make fresh installs clearer and reduce admin-squatting risk on public deployments.

Scope

• Detect when no admin user exists.
• Offer a clear setup path for the first administrator.
• Support a one-time setup token or equivalent operator-controlled proof.
• Keep manual SQL bootstrap documented as a fallback.

Acceptance criteria

• A fresh install has a documented, explicit way to create the first admin.
• The setup path cannot be reused after an admin exists.
• Existing installs keep their current admins and do not get prompted.