Create the first administrator with a generated password kept in a Secret

The bootstrap hook created `admin` with no password, so the account could
only use its API key and could not sign in on the web UI or the TUI. It
also won the one-shot /api/bootstrap against whoever ran it by hand, and
failed with exit 1 when the Secret already existed, which fails the Helm
release.

The hook now generates a 32-character password, stores username, password
and api-key in the <release>-admin-key Secret, and reuses the stored
password on later runs, so recreating the database brings the same
account back. The password is written before the account is created, so a
crash in between cannot leave an administrator nobody has the password
for. When the server was bootstrapped by something else, it checks the
stored password against /api/login and removes only the password it
generated if that does not sign in, then exits cleanly. bootstrap.enabled:
false still removes the hook and its role.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

docs/single-sign-on.md

@@ -101,5 +101,5 @@ A login expires after 10 minutes. `GET /api/auth/config` reports `device_login`.
 use) and password login is the way in. With `TERDUT_PASSWORD_LOGIN=false` that way
 is closed: set it back to `true`. The first administrator comes from the bootstrap
 endpoint, and stays a manual administrator that no group can revoke; on an SSO-only
-install set `bootstrap.enabled: false` in the chart if you don't want that account,
-or keep it and never give it a password.
+install set `bootstrap.enabled: false` in the chart if you don't want that account;
+left on, the chart creates it with a generated password kept in the `<release>-admin-key` Secret.