Bootstrap Claim

Claim the platform's bootstrap token to create the first operator.

On first boot the init container generates a random token, prints it to stdout, and stores its sha256 in the platform authority manifest. The operator presents the cleartext token here exactly once; in exchange they get a person record, a can_admin grant on the authority artifact, and an access token. After this call, platform.setup_complete=true blocks any further claim attempts.

Single-use. Consumes the bootstrap regardless of email/password — if those fields are absent, the operator is created passwordless and can later link an OAuth provider, set a password, or register a passkey.