feat(admin): first-run bootstrap latch + CLI setup [operator §3]

No trust-on-first-use: bootstrap mode is an explicit, MAC-protected latch
(server_config singleton), NOT inferred from "no admin keys". The latch MAC
(ADMIN_KEY_INTEGRITY_SECRET over setup_state|bootstrap_completed_at) means a
DB-write attacker who restores a pre-bootstrap backup or flips the state to
re-open TOFU produces a mismatch the boot path detects and fails closed on.

- migration 20260626000002: server_config (id=1 singleton; setup_state +
  bootstrap_completed_at + integrity_mac).
- db::server_config: read_setup_state -> {Fresh,Uninitialized,Locked,Tampered}
  (MAC-verified); has_any_users; init_server_config (adoption: a live upgrade
  latches `locked` so it never exposes a setup window; a truly empty DB begins
  uninitialized); bootstrap_admin (insert the FIRST active admin AND latch
  locked + hash-chained audit, ONE tx; refuses if an active admin already
  exists); reset_setup (shell recovery; recomputes MAC, preserves admin keys).
- main boot (admin enabled): adopt/await-bootstrap, and FAIL CLOSED on a tampered
  latch.
- smirk-admin: `setup --pubkey` (the supported headless bootstrap) + `reset-setup
  --i-understand`.
- 1 L1 test: Fresh -> locked(valid) -> wrong-secret Tampered -> raw-flip Tampered
  -> reset Uninitialized -> bootstrap refused while an active admin exists.

Deferred (documented): the HTTP /setup/* wizard. Per the spec the CLI / `docker
exec` is the SUPPORTED bootstrap (pure-PaaS without shell is explicitly
unsupported), so the loopback TTY wizard is a later convenience, not load-bearing.

src/bin/smirk-admin.rs

@@ -36,6 +36,8 @@ USAGE:
     smirk-admin <COMMAND> [FLAGS]
 
 COMMANDS:
+    setup               --pubkey <64hex>          (first-run: seed the admin + latch)
+    reset-setup         --i-understand
     list-keys
     add-key             --pubkey <64hex> [--label <s>]
     revoke-key          --id <uuid>
@@ -84,6 +86,8 @@ async fn run(args: &[String]) -> Result<(), String> {
     let db = Database::new(pool, String::new(), String::new());
 
     match cmd.as_str() {
+        "setup" => setup_cmd(&db, &secret, rest).await,
+        "reset-setup" => reset_setup_cmd(&db, &secret, rest).await,
         "list-keys" => list_keys(&db).await,
         "add-key" => add_key(&db, &secret, rest).await,
         "revoke-key" => revoke_key(&db, &secret, rest).await,
@@ -155,6 +159,29 @@ fn preflight_env_perms() -> Result<(), String> {
 
 // ── commands ─────────────────────────────────────────────────────────────────
 
+async fn setup_cmd(db: &Database, secret: &str, args: &[String]) -> Result<(), String> {
+    let pubkey = validate_pubkey(&require_flag(args, "--pubkey")?)?;
+    db.bootstrap_admin(&pubkey, secret)
+        .await
+        .map_err(|e| e.to_string())?;
+    println!("bootstrapped: active admin {pubkey}");
+    println!("setup latched (locked); the network admin plane is now usable");
+    Ok(())
+}
+
+async fn reset_setup_cmd(db: &Database, secret: &str, args: &[String]) -> Result<(), String> {
+    if !has_flag(args, "--i-understand") {
+        return Err(
+            "reset-setup re-opens first-run setup; existing admin keys are preserved. \
+             Re-run with --i-understand to confirm"
+                .into(),
+        );
+    }
+    db.reset_setup(secret).await.map_err(|e| e.to_string())?;
+    println!("setup reset to uninitialized (existing admin keys preserved)");
+    Ok(())
+}
+
 async fn list_keys(db: &Database) -> Result<(), String> {
     let keys = db.list_admin_keys().await.map_err(|e| e.to_string())?;
     if keys.is_empty() {