fix: stop logging bootstrap password as structured param + drop userCount from bootstrap-state

[devin-ai-integration]

Summary

Two security fixes found during a codebase audit:

1. Bootstrap password leaked to structured logging sinks (CWE-532)

UserService.BootstrapAsync logged the generated break-glass password as a structured parameter {Password}, which Serilog (and any downstream sink — Seq, ELK, Datadog) indexes as a searchable field. The password now goes to stderr only (visible in the container's initial console output, not persisted by the logging pipeline):

- logger.LogWarning("BOOTSTRAP_ADMIN_PASSWORD (generated, capture now): {Password}", password);
+ Console.Error.WriteLine($"BOOTSTRAP_ADMIN_PASSWORD (generated, capture now): {password}");
+ logger.LogWarning("Generated bootstrap admin password — capture from stderr. It will not be shown again.");

2. /api/auth/bootstrap-state returned userCount without a session

The endpoint is reachable through the BFF without an active session (the BFF attaches the admin token but sets identity to Anonymous). ownerExists is needed for the bootstrap flow; userCount is not and leaks how many users exist. Removed the unnecessary ListAsync() call and the userCount field from the response + the frontend BootstrapState type.

Link to Devin session: https://app.devin.ai/sessions/32fc2dfa3f9f4852af604fbaed8dca4c
Requested by: @skyp1nus

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring