docs: project docs, scripts, deployment configs, and evidence

docs/evidence/ops/2026-03-27/e2e/ADMIN_BOOTSTRAP_CLOSURE_20260327-173914.md

@@ -0,0 +1,59 @@
+# Admin Bootstrap Closure Evidence
+
+Generated at: `2026-03-27 17:39:14 +08:00`
+
+## Scope
+
+This evidence package covers the first-admin bootstrap closure for the current repository state:
+
+- public backend endpoint: `POST /api/v1/auth/bootstrap-admin`
+- public frontend route: `/bootstrap-admin`
+- login/register first-run entry points
+- supported-browser validation for `首次管理员初始化 -> 进入后台 -> 登出`
+
+## Implemented closure
+
+- Backend:
+  - added one-time admin bootstrap service flow guarded by `GET /api/v1/auth/capabilities -> admin_bootstrap_required`
+  - bootstrap now creates the first active admin, binds the `admin` role, issues a real session, and closes the bootstrap window afterward
+- Frontend:
+  - added `/bootstrap-admin` page
+  - added login/register entry points when bootstrap is still required
+  - added post-bootstrap auto-login into `/dashboard`
+- E2E:
+  - `frontend/admin/scripts/run-playwright-auth-e2e.ps1` no longer depends on startup-injected admin credentials
+  - the Playwright CDP suite now validates real bootstrap creation before the rest of the admin workflow scenarios
+
+## Verification executed
+
+```powershell
+go test ./... -count=1
+go build ./cmd/server
+
+cd D:\project\frontend\admin
+npm.cmd run lint
+npm.cmd run test:run
+npm.cmd run build
+powershell -ExecutionPolicy Bypass -File .\scripts\run-playwright-auth-e2e.ps1
+```
+
+## Latest supported-browser result
+
+The latest real-browser run completed with:
+
+- `PASS admin-bootstrap`
+- `PASS public-registration`
+- `PASS email-activation`
+- `PASS login-surface`
+- `PASS auth-workflow`
+- `PASS responsive-login`
+- `PASS desktop-mobile-navigation`
+- `Playwright CDP E2E completed successfully`
+
+## Real boundary
+
+- This closes the product loop for first-admin initialization in the current supported browser-validation environment.
+- It does not change the previously stated external boundaries:
+  - no live third-party OAuth provider evidence yet
+  - no live external SMTP provider deliverability evidence yet
+  - no external production delivery/governance evidence beyond the local auditable package already formed in-repo