deploy: auto-bootstrap first super_admin on startup (ADMIN_* env)

With this, a fresh deploy provisions its own first super_admin automatically:
after alembic migrations the entrypoint runs scripts/bootstrap_super_admin.py
when ADMIN_EMAIL + ADMIN_PASSWORD are set (idempotent, never overwrites an
existing password; org name/slug optional). This removes the chicken-egg where
login needs a user but no UI/seed could create the very first one.

Optionally runs only when both env vars are present, so an existing deployment
is unaffected. Verified: bash syntax ok; fresh DB produced org+password+
super_admin; re-run left the existing password unchanged.

backend/docker_entrypoint.sh

@@ -32,5 +32,19 @@ echo "[entrypoint] Running database migrations (alembic upgrade head)..."
 uv run --frozen alembic upgrade head
 echo "[entrypoint] Migrations complete."
 
+# Idempotent first-admin bootstrap. Only runs when ADMIN_EMAIL and
+# ADMIN_PASSWORD are provided; it creates/updates a super_admin user and org
+# (never overwrites an existing password). Optional in the image so a deployed
+# container can self-provision its first super_admin on startup.
+if [[ -n "${ADMIN_EMAIL:-}" && -n "${ADMIN_PASSWORD:-}" ]]; then
+  echo "[entrypoint] Bootstrapping first super_admin (${ADMIN_EMAIL})..."
+  uv run --frozen python scripts/bootstrap_super_admin.py \
+    --email "${ADMIN_EMAIL}" --password "${ADMIN_PASSWORD}" \
+    --org "${ADMIN_ORG_NAME:-Acme}" --slug "${ADMIN_ORG_SLUG:-}"
+  echo "[entrypoint] super_admin bootstrap complete."
+else
+  echo "[entrypoint] ADMIN_EMAIL/ADMIN_PASSWORD not set; skipping auto bootstrap."
+fi
+
 echo "[entrypoint] Starting supervisord (nginx + backend + worker)..."
 exec /usr/bin/supervisord -n