AI Implementation feature(846): First-Start Create Admin Modal 1.05 (#8)

docs/guides/bootstrap.md

@@ -3,7 +3,7 @@ type: guide
 title: First-Run Bootstrap
 description: How a fresh HIPCTF instance is initialized by the very first administrator.
 tags: [guide, bootstrap, first-admin, onboarding, tester]
-timestamp: 2026-07-21T16:48:20Z
+timestamp: 2026-07-21T17:18:08Z
 ---
 
 # When this flow runs
@@ -15,12 +15,15 @@ to create the very first admin user. This is gated by the
 | `initialized` | User experience                                              |
 |---------------|---------------------------------------------------------------|
 | `false`       | Every route is redirected to `/bootstrap` until an admin is created. |
-| `true`        | The setup route becomes a 404 and the modal can never appear again.   |
+| `true`        | The setup endpoint becomes a 409 `SYSTEM_INITIALIZED` and the modal can never appear again.   |
 
 The `authGuard` enforces the redirect on the client side; the backend
-independently rejects `/api/v1/setup/create-admin` with `404 NOT_FOUND`
-once any admin row exists, so the flow is safe even if the SPA is
-bypassed.
+independently rejects `/api/v1/setup/create-admin` with
+`409 SYSTEM_INITIALIZED` once any admin row exists, so the flow is safe
+even if the SPA is bypassed. Concurrent first-admin requests are
+serialized inside the Nest process so that two simultaneous submissions
+cannot both succeed — the loser receives the same `SYSTEM_INITIALIZED`
+409 (see [Setup Endpoint — Concurrency](/api/setup.md)).
 
 # How to access (tester steps)