AI Implementation feature(843): First-Start Create Admin Modal 1.02 (#5)

docs/guides/bootstrap.md

@@ -3,7 +3,7 @@ type: guide
 title: First-Run Bootstrap
 description: How a fresh HIPCTF instance is initialized by the very first administrator.
 tags: [guide, bootstrap, first-admin, onboarding, tester]
-timestamp: 2026-07-21T15:05:00Z
+timestamp: 2026-07-21T16:09:53Z
 ---
 
 # When this flow runs
@@ -40,7 +40,8 @@ bypassed.
    - **Confirm Password** — must equal the password above (verified by
      the group-level `passwordMatchValidator`; mismatch shows
      `data-testid="setup-confirm-error"`).
-5. Click **Create admin** (`data-testid="setup-submit"`).
+5. Click **Create admin** (`data-testid="setup-submit"`). The button remains enabled while the form is invalid so this validation flow can be triggered; it is disabled only while a submission is in progress.
+6. To verify client-side validation, submit with empty or partial fields. The overlay stays open, the relevant field errors appear, and no administrator is created or setup request is sent.
 
 # Expected behavior
 
@@ -69,7 +70,7 @@ The modal **cannot** be dismissed by the user:
 | Username input                 | `[data-testid="setup-username"]` | Reactive control with length/pattern rules.   |
 | Password input                 | `[data-testid="setup-password"]` | Reactive control.                             |
 | Confirm input                  | `[data-testid="setup-password-confirm"]` | Reactive control.                     |
-| Submit button                  | `[data-testid="setup-submit"]`   | Disabled while submitting or invalid.         |
+| Submit button                  | `[data-testid="setup-submit"]`   | Triggers validation even when invalid; disabled only while submitting. |
 | Server error alert             | `[data-testid="setup-server-error"]` | Displays `serverError()`.                 |
 | Retry button                   | `[data-testid="setup-retry"]`    | Re-submits; absent when the error is non-retryable. |
 | Password policy hint           | `.hint`                          | Live description from `BootstrapService.passwordPolicy()`. |