feat: add bootstrap and SMTP onboarding

docs/tests/integration/first-admin-bootstrap.md

@@ -0,0 +1,74 @@
+# Test Evidence: Atomic first administrator bootstrap
+
+- **Test type:** Integration
+- **Requirement IDs:** `ACC-001–ACC-004, SEC-001–SEC-002, GOV-013`
+- **Scenario IDs:** `AC-ACC-001, AC-ACC-002, AC-SEC-001`
+- **Test class/method:** `com.lab.labtimesheet.BootstrapIntegrationTest`
+- **Implementation commit:** `this milestone commit`
+
+## Protected behavior
+
+Before initialization only bootstrap and health are reachable. Concurrent valid submissions create exactly one active Admin, atomically persist initialization, and permanently close bootstrap.
+
+## Test method
+
+A PostgreSQL 18.4 integration test releases two Java 25 virtual-thread-safe requests onto the same service concurrently and asserts the row-locked outcomes and database state. MockMvc checks pre/post-bootstrap route exposure.
+
+## Hand-derived expected result
+
+Two simultaneous submissions produce one `CREATED`, one `ALREADY_INITIALIZED`, one Admin row, and one initialized singleton. Later bootstrap requests cannot create another Admin.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:/opt/homebrew/opt/node@24/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=BootstrapIntegrationTest,SmtpAccountIntegrationTest test
+```
+
+**Observed result**
+
+```text
+BootstrapIntegrationTest.java: cannot find symbol class BootstrapService
+17 compilation errors
+BUILD FAILURE
+```
+
+The public bootstrap behavior did not exist.
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:/opt/homebrew/opt/node@24/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=BootstrapIntegrationTest,SmtpAccountIntegrationTest test
+```
+
+**Observed result**
+
+```text
+Tests run: 3, Failures: 0, Errors: 0, Skipped: 0
+BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+./mvnw test
+Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
+BUILD SUCCESS
+```
+
+The command used the Java 25 and OrbStack environment exports shown above.
+
+## External-test boundaries
+
+This test does not prove deployment-network privacy for the temporary bootstrap route. Operations must still bootstrap on a private interface before public exposure.