Add atomic initial owner bootstrap

docs/DOGFOOD.md

@@ -38,3 +38,8 @@ application concern belongs in the shared module.
   ceremony and checking its user only after persistence is too late.
   `FinishRegistrationForUser` now consumes mismatched ceremonies and checks
   the application-authenticated user before storing a credential.
+- First-owner provisioning exposed another cross-package transaction boundary.
+  `bootstrap` now commits the passkey-only user, enrollment digest,
+  non-personal organization, membership, direct owner binding, and audits
+  together. Applications must seed their owner role first and must write the
+  returned raw token only to a newly created private file.

docs/GETTING_STARTED.md

@@ -19,13 +19,14 @@ install an imagined framework lifecycle around it.
 | SQLite persistence for `auth` | `authsqlite` | Database placement, backup, migration approval, and recovery |
 | One account across organizations and teams | `organizations`, `authsqlite` | Invitation UX, organization naming, and lifecycle policy |
 | Organization-scoped authorization | `access`, `authsqlite` | Role definitions, resource ownership, and route enforcement |
+| First passkey-only owner and home organization | `bootstrap`, `authsqlite` | Root-local command, private token file, enrollment page, and owner-role policy |
 | Aggregate projections over request records | `analytics` | Collection policy, access control, report UI, and retention |
 
 The packages are ordinary Go imports. Pin the current preview and verify its
 module checksum:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.11
+go get gamertan.com/web/requestmeta@v0.1.0-preview.12
 go mod verify
 ```
 
@@ -61,6 +62,17 @@ quietly changing identity or policy.
 
 ## Bootstrap an account without inventing a permanent password
 
+For the first application owner, prefer `bootstrap.Start`. After explicitly
+seeding the application's access policy, it creates the active passkey-only
+user, non-personal home organization, membership, direct owner binding,
+enrollment digest, and audit events in one repository transaction. A missing
+owner role or duplicate identity rolls back every row. The application-owned
+root-local command writes the returned raw enrollment token once to an
+exclusive mode-`0600` file and must never print or log it.
+
+For applications that still require a temporary password bootstrap,
+`auth.GenerateTemporaryPassword` remains available:
+
 `auth.GenerateTemporaryPassword` returns 256 bits of URL-safe cryptographic
 entropy. An application can store that value in a newly created private file
 and provision an account with `RequirePasswordChange: true`. The library does

docs/MODULES.md

@@ -18,7 +18,7 @@ import "gamertan.com/web/requestmeta"
 and request the containing module at an exact version:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.11
+go get gamertan.com/web/requestmeta@v0.1.0-preview.12
 ```
 
 Only imported packages are compiled and linked. The packages nevertheless

docs/PASSKEYS.md

@@ -26,8 +26,11 @@ timestamp, UUID, or counter for the random challenge.
 
 ## Application flow
 
-1. A local command calls `Bootstrap` or `Recover` and writes the returned
-   enrollment token once to a newly created mode-`0600` file.
+1. A local command calls `authwebauthn.Bootstrap`, `authwebauthn.Recover`, or
+   `bootstrap.Start` and writes the returned enrollment token once to a newly
+   created mode-`0600` file. Use `bootstrap.Start` for the first application
+   owner so identity, organization membership, direct owner access, and audits
+   cannot be partially committed.
 2. A server-rendered enrollment page calls `BeginEnrollment`; the browser uses
    `navigator.credentials.create` with the returned `public_key` value.
 3. The browser posts the credential and opaque ceremony token to a bounded JSON