fix(dashboard): seed default operator, fix infinite /setup redirect

[AbirAbbas]

Problem

Signing into the operator dashboard infinitely redirected back to the setup screen, and the console offered a public "Create operator account" signup that doesn't make sense for an operator console.

Root cause of the redirect: operator status lives in a separate suite_operators table, populated only as a side-effect of the first better-auth signup — inside one all-or-nothing transaction that also wrote suite_users + suite_memberships (the latter depends on a default-tenant row existing). Any partial failure rolled the whole thing back, so suite_operators stayed empty, operatorCount() stayed 0 forever, and /login, /, and everything else bounced to /setup.

Approach

Replace the fragile signup-bootstrap with a seeded default operator account, so there's never an operator-less state:

1. Seed a default operator on first boot (lib/bootstrap-operator.ts, run from a Next.js instrumentation.ts hook). Credentials are configurable via AF_STACK_DEFAULT_OPERATOR_EMAIL / _PASSWORD / _NAME and documented in the README + .env.example. The seed is idempotent (gated on an empty suite_operators table — never re-runs, never clobbers a changed password), login-compatible (hashes with better-auth/crypto, writes the credential account row), and resilient to boot ordering (retries until the migrated auth tables exist; never crashes the process).
2. Harden the mirror hook — the user.create hook's three mirror steps now run independently/best-effort, so a partial failure can never undo operator creation again. Also set emailAndPassword.disableSignUp to close public self-provisioning.
3. Remove the first-run wizard — delete the /setup and /signup pages, the count===0 → /setup redirects, the allow-list entries, and the login-form "Sign up" link. The admin layout relies on requireOperator() alone.

Default credentials

Field	Default
Email	operator@af-stack.local
Password	changeme123

Documented in the README with change-password guidance and an AF_STACK_DEFAULT_OPERATOR_DISABLED opt-out. Scope was confirmed with the requester as "fix login + default account now"; an in-dashboard "add more operators" UI is intentionally left as a follow-up.

Validation contract

• Fresh boot (no operators) → exactly one operator exists after the dashboard starts; operatorCount() == 1.
• /login always shows the sign-in form (never redirects to /setup).
• Sign-in with the default credentials lands on / with no redirect loop.
• Seed is idempotent across restarts; a changed password is never reset.
• Credentials are env-configurable and documented.
• Public self-signup is gone (pages removed + disableSignUp).
• Mirror-hook partial failure can't leave the deployment operator-less.

Testing

• tsc --noEmit clean; eslint clean on all changed files; prettier --check clean.
• Built on a fresh worktree off latest origin/main (unrelated local changes excluded).
• Not yet exercised end-to-end against a live docker compose up — worth a manual smoke (boot fresh stack, sign in with the default account).

Note (separate concern, flagged by the requester)

The customer app and operator dashboard share the same better-auth user/account tables, so one credential authenticates against both — operator access is gated only at authorization (suite_operators). Tracking that separately (see follow-up issue).

🤖 Generated with Claude Code

[AbirAbbas]

The shared customer/operator identity concern noted above is now tracked in #120.