Bootstrap admin

Use once per deployment with BOOTSTRAP_TOKEN when no admin exists yet (installer seeds ot_admin automatically; use this only as a backup path).