fix(auth): remove redundant startup bootstrap user creation

The login endpoint already provisions the first admin user on demand
with a proper password_hash. The startup block in main.py created the
user without a password_hash, causing the login endpoint to see
has_admins=True and reject bootstrap credentials with 403.

Fix: remove the startup user-creation block so the login endpoint's
bootstrap path runs first and provisions the user correctly.

backend/app/main.py

@@ -178,26 +178,6 @@ async def lifespan(app: FastAPI):
     except Exception as e:
         print(f"  WARNING: Failed to write theme.json on startup: {e}")
 
-    # Bootstrap admin user if configured
-    if settings.ADMIN_USERNAME and settings.ADMIN_PASSWORD:
-        async with async_session() as session:
-            result = await session.execute(
-                select(User).where(
-                    User.email == f"{settings.ADMIN_USERNAME}@local",
-                    User.auth_provider == "local",
-                )
-            )
-            if result.scalar_one_or_none() is None:
-                admin_user = User(
-                    email=f"{settings.ADMIN_USERNAME}@local",
-                    display_name=settings.ADMIN_USERNAME,
-                    auth_provider="local",
-                    is_admin=True,
-                )
-                session.add(admin_user)
-                await session.commit()
-                print(f"  → Bootstrap admin created: {settings.ADMIN_USERNAME}")
-
     # Check GeoLite2 database
     geo_db = settings.GEOLITE2_DB_PATH
     if os.path.exists(geo_db):