fred
8a2473da11
ci/woodpecker/pr/ci Pipeline was successful
POST /api/bootstrap/setup checked the zero-user count and then created the first admin with nothing making the two atomic, so two concurrent setup requests could both pass the check and each create an admin user plus an admin API token. Setup now runs inside a db.transaction that first takes pg_advisory_xact_lock(BOOTSTRAP_SETUP_LOCK_KEY): the second concurrent caller blocks until the first commits, re-reads the count, and gets 403. The lock is transaction-scoped, so it also serializes across gateway replicas sharing the database. Spec: mock db gained transaction/execute; new assertions pin lock-before-count ordering, and a new suite pins 403 + no createUser call when users already exist. Closes #1430