Add controlled first-admin enrollment

src/govoplan_core/settings.py

@@ -271,6 +271,19 @@ class Settings(BaseSettings):
     dev_bootstrap_password: str = Field(default="dev-admin", alias="DEV_BOOTSTRAP_PASSWORD")
     dev_mailbox_api_enabled: bool = Field(default=False, alias="DEV_MAILBOX_API_ENABLED")
 
+    # Production first-administrator enrollment. The credential is issued only
+    # by the local operator command and is unrelated to development bootstrap.
+    first_admin_enrollment_ttl_seconds: int = Field(
+        default=30 * 60,
+        ge=60,
+        le=24 * 60 * 60,
+        alias="FIRST_ADMIN_ENROLLMENT_TTL_SECONDS",
+    )
+    first_admin_enrollment_file: str = Field(
+        default="/run/govoplan/first-admin-enrollment.json",
+        alias="FIRST_ADMIN_ENROLLMENT_FILE",
+    )
+
     # Comma-separated list. Use * only for local development.
     cors_origins: str = Field(default="http://localhost:5173,http://127.0.0.1:5173,http://localhost:8080", alias="CORS_ORIGINS")