Context

Subtask of #209 (programmatic setup). ENV-var bootstrap (the companion subtask) suits Docker/K8s operators whose manifests already carry env config. The API-first alternative — Zitadel's model — suits operators who refuse plaintext secrets in environment variables at all: a machine-facing setup surface, distinct from the admin UI, where first boot is a single HTTP call that returns a machine credential.

Proposal

• POST /api/setup — one-shot, unauthenticated by necessity (no users exist yet), accepts the same inputs as the wizard: tenant_base_domain, user params, and optionally a first application
• Gated exactly like the wizard: Stats.count_users() > 0 → 410 Gone (an API response, not a redirect)
• On success: mints and returns (once) an admin PAT, plus the org/app credentials — using the same JSON envelope as the rest of the Management API
• Rate-limited; audit-logged (:bootstrap_setup_completed, following the existing log_audit_event naming style)
• OpenAPI path documented alongside the existing paths
• The setup wizard remains the human path; this endpoint and the wizard share the Authify.Bootstrap core so behavior cannot drift

Security notes

• Unauthenticated-by-gating: the endpoint exists and functions only on a fresh install; the 410 response on any subsequent call makes the attack window exactly the same as the wizard's
• PAT returned once, never retrievable again

Acceptance criteria

• curl -X POST /api/setup on a fresh install returns a working PAT — zero HTML, zero scraping
• Second call → 410; after wizard used → 410
• OpenAPI documents the path

Related: #209