First run? Register the initial admin via POST /auth/register (no caller required while the users table is empty).