docs(operator): OPERATOR_SETUP guide + fix .env.example peppers + README bootstrap

- .env.example: add the required at-rest identity secrets (SEED_FINGERPRINT_PEPPER,
  REFRESH_TOKEN_PEPPER, IP_SALT). They were missing, so `cp .env.example .env` on a
  fresh setup boot-failed closed on the first required-secret check.
- README: correct the first-admin bootstrap to `smirk-admin setup --pubkey`.
  create-admin-wallet registers a pending key but does not latch, so on a fresh
  instance it leaves the bootstrap uninitialized.
- docs/operations/OPERATOR_SETUP.md: full deployment guide — database, secrets,
  per-chain backends, run + verify, admin bootstrap, registration policy, and
  smoke-testing an instance (SMOKE_API_STYLE=namespaced).

Surfaced by a clean-room operator setup against a fresh instance.

README.md

@@ -83,13 +83,16 @@ inconsistent feature configuration rather than booting with a control silently
 defeated. Generate secrets with `openssl rand -hex 32`. See
 [`.env.example`](.env.example) for the full, documented configuration surface.
 
-First admin (headless — the supported bootstrap):
+First admin (headless bootstrap):
 
 ```sh
-smirk-admin create-admin-wallet --out admin.secret  # generates a key, registers the pubkey
-# import admin.secret into your NIP-98 signer; it activates on first admin login
+smirk-admin setup --pubkey <x-only-hex>   # seed the first admin + latch the bootstrap
 ```
 
+`<x-only-hex>` is the admin's Sign-in-with-Smirk (Nostr) public key; the admin
+then authenticates with the matching key over NIP-98. Full deployment guide:
+[docs/operations/OPERATOR_SETUP.md](docs/operations/OPERATOR_SETUP.md).
+
 ## Security posture
 
 - **Fail-closed configuration** — the only place that reads the environment;