provisioning: drop multi-user remnants, provision the super admin on bootstrap

Remove the multi-user provisioning leftovers (the provision-existing-users.sh
migration was already deleted in the prior commit):
- gut provisionVncEnv from provision.ts (per-user startxfce4 virtual desktop, dead
  since the switch to mirroring :0 — vnc-manager.ts self-provisions its own passwd)
- drop the Pi `.pi/agent/sessions` seed and the now-orphaned `run` helper

Wire provisioning into bootstrapHandler: the super admin (first user) is created via
createUser, which never called provisionUserEnvironment — only the invite/verify flow
did. So the single user's DATA_PATH/<email> was never provisioned up front. Now it is.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

TODO.md

@@ -14,11 +14,11 @@ Deferred work. Context: Officer is collapsing from multi-tenant / open-source-re
       `channels/send-claude-code.ts`. After this, `toShellUsername` has one caller left
       (`provision.ts` → `generateClaudeSettings`) and may be inlinable.
 
-- [ ] **Delete or gut `scripts/provision-existing-users.sh`.** Line ~100 runs
-      `sudo useradd -d "$HOME_DIR" -s /bin/zsh -M "$shell_user"`. This is what created the four
-      vestigial Unix accounts (`andrepadez`, `john-wick`, `fedra`, `miguelbenoliel`) that cluttered
-      the lightdm greeter. Nothing in the server creates Unix users; if this script runs again they
-      come back.
+- [x] **Delete or gut `scripts/provision-existing-users.sh`.** Done — deleted the script (it ran
+      `sudo useradd …`, the source of the vestigial `andrepadez`/`john-wick`/`fedra`/`miguelbenoliel`
+      Unix accounts). Also dropped the dead per-user VNC desktop provisioning (`provisionVncEnv`, the
+      `startxfce4` xstartup) from `provision.ts` — the mirror self-provisions its passwd in
+      `vnc-manager.ts` — and the Pi `.pi/agent/sessions` seed.
 
 - [ ] **Collapse the rest of the multi-tenant machinery.** Candidates, in rough order of payoff:
       roles (`Super Admin`/`Member`), the sandboxed-vs-unsandboxed path split, per-email home dirs