Lock bootstrap admin token until password is changed.

Closes #2: bootstrap JWTs cannot mutate admin APIs except change-password, production requires ADMIN_PASSWORD on first boot, admin binds loopback.

internal/auth/jwt_test.go

@@ -32,6 +32,32 @@ func TestJWTManager_GenerateValidate_Roundtrip(t *testing.T) {
 	}
 }
 
+func TestJWTManager_BootstrapClaim(t *testing.T) {
+	m := NewJWTManager("test-secret-123")
+	token, err := m.GenerateBootstrapToken(1, "admin.com", "Admin", []string{"admin"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	claims, err := m.ValidateToken(token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !claims.Bootstrap {
+		t.Error("bootstrap token missing claim")
+	}
+	full, err := m.GenerateToken(1, "admin.com", "Admin", []string{"admin"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fullClaims, err := m.ValidateToken(full)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fullClaims.Bootstrap {
+		t.Error("normal token should not be bootstrap")
+	}
+}
+
 func TestJWTManager_EmptySecretRandomRoundtrip(t *testing.T) {
 	m := NewJWTManager("") // empty -> random in-memory secret
 	token, _ := m.GenerateToken(1, "a@b", "A", nil)