fix(web): first-run bootstrap — do not gate on an operator cert before a signed Root CA exists

[Bugs5382]

Finding (surfaced during ESXi E2E, 2026-07-21)

auth-gate.tsx denies with "No valid operator certificate" whenever WhoAmI does not resolve to an operator. But at true first setup a fresh fleet has no signed Root CA and therefore no operator CA to issue operator certs — a chicken-and-egg: you cannot get in to create the Root CA, and you cannot issue an operator cert until the Root CA (operator CA) exists.

Shane: "not until you have at least one signed Root CA" — the operator-cert gate must be conditional on the fleet being bootstrapped.

Proposed

• Manager reports fleet bootstrap state (is there >= 1 established Root CA / is an operator CA configured?).
• Web auth-gate: when NOT bootstrapped, enter a first-run setup mode that does not require an operator cert — enough to adopt/create the first Root CA and designate the operator CA, then issue the first operator credential (S9).
• Once bootstrapped, enforce operator-cert auth as today.

Orthogonal to the dev authBypass path (which already skips the gate for local dev); real production first-run needs it. Part of the Full Web Parity program (manager#24).