The login endpoint already provisions the first admin user on demand
with a proper password_hash. The startup block in main.py created the
user without a password_hash, causing the login endpoint to see
has_admins=True and reject bootstrap credentials with 403.
Fix: remove the startup user-creation block so the login endpoint's
bootstrap path runs first and provisions the user correctly.
