feat(setup): canonical bootstrap endpoint + legacy migration

[shiba4life]

Summary

Additive first step toward collapsing the three first-launch paths
(CLI wizard, web UI onboarding, silent auto-init in get_database_status)
into one canonical server-side handler. This PR introduces the new
endpoint and a boot-time migration; the existing paths keep working
alongside so we can validate before flipping clients over.

Tracks kanban task 973ff. Subsequent PRs (filed as separate tasks)
rename load_or_generate → provision, strip the auto-init branch,
and port the CLI + React clients.

What's in here

• POST /api/setup/bootstrap (src/server/routes/setup.rs) — single
  handler for fresh-mint and recovery-phrase restore. Self-disables on
  .onboarding_complete (410 Gone). Atomic-on-failure: identity tree,
  credentials, anthropic key, and config files all roll back if any
  post-identity step fails.
• Boot-time legacy migration (StartupCtx::boot) — re-encrypts
  plaintext identities (legacy CLI installs) under the keychain master
  key, synthesizes a missing .onboarding_complete marker when an
  identity already exists. Idempotent; conservative (no marker for
  never-set-up nodes).
• Loopback bind invariant (bin/folddb_server.rs) — bind helper
  extracted, two tests assert 127.0.0.1 for default and arbitrary
  ports. The bootstrap auth model rests on this: no token, just one-shot
  marker file + loopback isolation.
• Shared FOLDDB_HOME test lock (src/utils/test_lock.rs) — three
  test modules were racing each other on the env var via three private
  mutexes. Now they share one.

Out of scope (filed as follow-up kanban tasks)

• Rename identity::load_or_generate → identity::provision and gate to bootstrap-only
• Add NodeManagerError::NotProvisioned → HTTP 503 conversion
• Strip the auto-init branch from get_database_status
• Port the React onboarding wizard to a single bootstrap POST
• Port the folddb setup CLI wizard to a REST client
• Delete save_identity_card_via_local_node once the CLI port lands

Test plan

• cargo check --workspace
• cargo clippy --workspace --all-targets -- -D warnings -A dead_code
  (-A dead_code suppresses the pre-existing apple_import.rs:772
  warning that fires on macOS only — known issue, unrelated)
• cargo test --lib — 934 pass
• cargo test --bins — 11 pass
• cd src/server/static-react && npm test — 676 pass, 6 skipped
• New tests: marker 410 path, missing-invite-code 400, invalid
  birthday 400, marker_path resolves from FOLDDB_HOME, three
  migration regression tests (synthesize marker, idempotent, no-op
  on empty pool, re-encrypt under master key with os-keychain)
• Loopback bind tests for default + arbitrary ports
• Manual smoke: confirm fresh-install via UI/CLI still works
  end-to-end — those clients are unchanged in this PR; will be
  exercised more thoroughly when their respective port PRs land

🤖 Generated with Claude Code