feat(api): sign-in, refresh rotation and bootstrap admin (M1)

- users, refresh_tokens and audit_log schema (migration 00002)
- argon2id passwords with rehash on login, password policy, lockout
  with exponential back-off and a per-IP rate limit in Redis
- Ed25519 JWT access tokens with kid-based key rotation; rotating
  refresh tokens with reuse detection (cookie for web, body for Android)
- bootstrap admin on first start; must_change_credentials and
  must_change_password gate every other endpoint
- /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password,
  /me/bootstrap-credentials, /me/sessions; server-info reports
  bootstrap_required
- role policy from docs/auth-and-roles.md with table tests
- problem+json errors with field errors; ru/en translations of the codes
- install.sh and update.sh generate JWT_PRIVATE_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/system/handler.go

@@ -26,6 +26,8 @@ type Info struct {
 	Version               string
 	SupportedLocales      []string
 	MinAndroidVersionCode int
+	// BootstrapRequired сообщает, что первый вход администратора не завершён (nil — false).
+	BootstrapRequired func(ctx context.Context) (bool, error)
 }
 
 // Handler реализует системную часть gen.StrictServerInterface.
@@ -86,8 +88,16 @@ func (h *Handler) GetReadyz(ctx context.Context, _ gen.GetReadyzRequestObject) (
 }
 
 // GetServerInfo отдаёт сведения о сервере для экрана подключения клиентов.
-func (h *Handler) GetServerInfo(context.Context, gen.GetServerInfoRequestObject) (gen.GetServerInfoResponseObject, error) {
+func (h *Handler) GetServerInfo(ctx context.Context, _ gen.GetServerInfoRequestObject) (gen.GetServerInfoResponseObject, error) {
+	var bootstrap bool
+	if h.info.BootstrapRequired != nil {
+		var err error
+		if bootstrap, err = h.info.BootstrapRequired(ctx); err != nil {
+			return nil, err
+		}
+	}
 	return gen.GetServerInfo200JSONResponse{
+		BootstrapRequired:     bootstrap,
 		Name:                  "pipu-music",
 		Version:               h.info.Version,
 		ApiVersion:            "v1",