fix(onboarding): restrict bootstrap admin promotion

[BunsDev]

Motivation

• Prevent a privilege-escalation window where saveUseCaseFn could upgrade any existing non-admin principal to admin during partial onboarding.
• Ensure only true bootstrap scenarios (first human principal) allow automated admin promotion and avoid letting untrusted or portal principals gain admin rights.

Description

• Tighten ensureAdminPrincipal to: return early when the caller is already admin, refuse promotion if any human admin exists, and refuse promotion if any other human principal exists (adds and/ne checks and conservative guards).
• Move the bootstrap authorization check in saveUseCaseFn to run before writing settings.setupState so unauthorized callers cannot mutate partially-onboarded settings prior to rejection.
• Adjust log messages to reflect bootstrap-only behavior and import required DB operators (and, ne) while preserving original insert/upgrade behavior for true bootstrap cases.
• Add a targeted regression test apps/web/src/lib/server/functions/__tests__/onboarding-security.test.ts covering: existing non-admin + existing admin, existing non-admin + another human principal, and the valid first-bootstrap promotion path.

Testing

• Ran git diff --check which passed locally.
• Attempted bunx vitest run apps/web/src/lib/server/functions/__tests__/onboarding-security.test.ts but test execution was blocked due to dependency resolution failing against the npm registry (HTTP 403).
• Ran bun run typecheck which failed because type definition packages were unavailable after the install failure, preventing a full automated type-check pass.

---

Codex Task

[Copilot]

Pull request overview

This PR hardens onboarding security by restricting automated admin promotion to true bootstrap conditions and by moving the admin-authorization gate earlier to prevent unauthorized mutation of onboarding state.

Changes:

• Tightens ensureAdminPrincipal to only promote during bootstrap and to refuse promotion when any other human principal/admin exists.
• Moves the saveUseCaseFn bootstrap admin check earlier (before persisting settings.setupState) for partially-onboarded workspaces.
• Adds a regression test suite covering blocked promotion scenarios and the valid first-bootstrap promotion path.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
apps/web/src/lib/server/functions/onboarding.ts	Tightens bootstrap-only admin promotion and reorders authorization vs. settings writes in saveUseCaseFn.
apps/web/src/lib/server/functions/tests/onboarding-security.test.ts	Adds targeted tests to prevent regressions in onboarding admin-promotion security behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.