// POST /cms/auth/bootstrap — create the first admin/author account.
// Gated by the `setup-token` secret (compared server-side; never echoed).
// This exists because there is no CLI/API to grant an app-user a role —
// role assignment is script-only (users::add_role). See FINDINGS.
let b = ctx.request.body;
if b == () || b.setup_token == () {
    return #{ statusCode: 400, body: #{ error: "setup_token required" } };
}
let want = secrets::get("setup-token");
if want == () {
    return #{ statusCode: 500, body: #{ error: "server not configured for bootstrap" } };
}
if b.setup_token != want {
    return #{ statusCode: 403, body: #{ error: "bad setup token" } };
}
if b.email == () || b.password == () {
    return #{ statusCode: 400, body: #{ error: "email and password required" } };
}
if !users::email_available(b.email) {
    return #{ statusCode: 409, body: #{ error: "email already registered" } };
}
let u = users::create(#{ email: b.email, password: b.password, display_name: b.display_name });
users::add_role(u.id, "admin");
users::add_role(u.id, "author");
#{ statusCode: 201, body: #{ id: u.id, email: u.email, roles: ["admin", "author"] } }