Secure initial Roller setup with one-time operator token

[snoopdave]

Summary

• Require a cryptographically secure, one-time operator token before Roller initial setup, database installation actions, and first-user registration.
• Bind redemption to a browser session, expire it after 60 minutes, and prevent token exposure through URLs or rendered responses.
• Permanently close bootstrap access after the first administrator is committed, including after account deletion or disablement.
• Gate SSO auto-provisioning during bootstrap and document the operator workflow.
• On upgrade, the database upgrade screen is not shown unless there is an actual database upgrade to be done.

Validation

• mvn -pl app -DskipTests compile
• Focused BootstrapSecurityTest and InstallTest
• git diff --check

Here's what the new seucurity code looks like in roller.log:

And here's the new securoty code screen:

Release consideration

If we do an RC4, we should consider including this PR in that release candidate.