feat(admin): add first-admin bootstrap command

[ibourgeois]

Goal

Provide a safe CLI path to create or promote the first admin account.

Scope

• Add an Artisan command to create or promote an admin
• Support local and production bootstrap scenarios
• Ensure the command works with the Bouncer role model

Out of Scope

• Admin UI for role management
• Invite workflows

Acceptance Criteria

• A documented Artisan command can create or promote the first admin
• The command is idempotent or safely handles duplicate intent
• The command has focused test coverage where practical

Dependencies

• Depends on feat(authz): install Bouncer and establish baseline RBAC #10

Test Plan

• Add command tests for create and promote paths
• Manually verify command usage in a local environment