Fix auth throttle DoS and serialize admin bootstrap.

Evict/cap limiter keys, replace hard username lockouts with IP+user progressive delays cleared on success, and create bootstrap admins under the same advisory/mutex lock as role changes.

internal/store/memory.go

@@ -54,7 +54,17 @@ func (m *Memory) CreateUser(_ context.Context, u *User) error {
 	if u.CreatedAt == "" {
 		u.CreatedAt = time.Now().UTC().Format(time.RFC3339)
 	}
+	role := u.Role
+	if role == RoleAdmin {
+		for _, existing := range m.users {
+			if existing.Role == RoleAdmin {
+				role = RoleUser
+				break
+			}
+		}
+	}
 	cp := *u
+	cp.Role = role
 	cp.db = nil
 	m.users[cp.ID] = &cp
 	m.byName[cp.Username] = cp.ID