provisioning: drop multi-user remnants, provision the super admin on bootstrap

Remove the multi-user provisioning leftovers (the provision-existing-users.sh
migration was already deleted in the prior commit):
- gut provisionVncEnv from provision.ts (per-user startxfce4 virtual desktop, dead
  since the switch to mirroring :0 — vnc-manager.ts self-provisions its own passwd)
- drop the Pi `.pi/agent/sessions` seed and the now-orphaned `run` helper

Wire provisioning into bootstrapHandler: the super admin (first user) is created via
createUser, which never called provisionUserEnvironment — only the invite/verify flow
did. So the single user's DATA_PATH/<email> was never provisioned up front. Now it is.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/auth/bootstrap.ts

@@ -6,6 +6,7 @@ import argon2 from 'argon2';
 import * as errors from '@@/custom-errors';
 import { validatePassword } from './validate-password';
 import { validateUsername } from './validate-username';
+import { provisionUserEnvironment } from '../users/provision';
 
 export const bootstrapHandler: Handler = async function (ctx) {
   const body = ctx.get('body');
@@ -49,7 +50,7 @@ export const bootstrapHandler: Handler = async function (ctx) {
 
   const passwordHash = await argon2.hash(password);
 
-  await createUser({
+  const user = await createUser({
     email: payload.email,
     password: passwordHash,
     name: name.trim(),
@@ -58,5 +59,12 @@ export const bootstrapHandler: Handler = async function (ctx) {
     status: 'Active',
   });
 
+  // Provision the super admin's environment (DATA_PATH/<email> + configs) on creation. This is the only
+  // account-creation flow for a single-user platform, and — unlike the invite/verify flow — nothing
+  // else runs provisioning for the first user. Fire-and-forget, mirroring verifyHandler.
+  provisionUserEnvironment(user.email, user.username ?? validUsername).catch((err) => {
+    console.error('[bootstrap] failed to provision super admin environment:', err);
+  });
+
   return ctx.json({ ok: true });
 };

src/servers/api/auth/verify.ts

@@ -43,7 +43,7 @@ export const verifyHandler: Handler = async function (ctx) {
   const finalUser = await getUserById(userInfo.id);
   if (!finalUser) throw errors.NOT_FOUND('User not found');
 
-  // Provision user environment (directories, configs, VNC)
+  // Provision user environment (directories, configs)
   provisionUserEnvironment(finalUser.email, finalUser.username ?? '').catch((err) => {
     console.error('[verify] failed to provision user environment:', err);
   });