Feat: Prod-Bootstrap (Erst-Superadmin) + Contabo-Runbook

- scripts/bootstrap-admin.ts: legt ersten Plattform-Admin + Mandant via
  provisionTenant(isPlatformAdmin) an; idempotent, per Env gesteuert. Ersetzt in
  Prod den Demo-Seed. tsx-@/-Auflösung lokal verifiziert.
- docker-compose.coolify.yml: migrate-Job führt bei BOOTSTRAP_ADMIN=true das Skript
  nach der Migration aus; BOOTSTRAP_*-Vars durchgereicht.
- .env.prod.example: Prod-Env-Referenz (HTTPS, kein Demo-Seed, Bootstrap-Vars).
- docs/DEPLOY-PROD-CONTABO.md: Runbook (VPS-Härtung/Swap, Coolify+Gitea, DNS/TLS
  app.certvia.de, Deploy, Bootstrap, Backups, Go-Live-Checkliste).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.coolify.yml

@@ -14,10 +14,19 @@ services:
     build:
       context: .
       target: builder
-    command: sh -c "npx prisma migrate deploy && if [ \"$$RUN_DEMO_SEED\" = \"true\" ]; then echo '>> Demo-Seed läuft…'; npx tsx prisma/seed.ts; else echo '>> Demo-Seed übersprungen (RUN_DEMO_SEED != true)'; fi"
+    command: sh -c "npx prisma migrate deploy && if [ \"$$RUN_DEMO_SEED\" = \"true\" ]; then echo '>> Demo-Seed läuft…'; npx tsx prisma/seed.ts; fi && if [ \"$$BOOTSTRAP_ADMIN\" = \"true\" ]; then echo '>> Bootstrap-Admin läuft…'; npx tsx scripts/bootstrap-admin.ts; fi"
     environment:
       DATABASE_URL: ${DATABASE_URL}
+      # Test: Demo-Seed. Produktiv: stattdessen BOOTSTRAP_ADMIN (Erst-Superadmin).
       RUN_DEMO_SEED: ${RUN_DEMO_SEED:-false}
+      BOOTSTRAP_ADMIN: ${BOOTSTRAP_ADMIN:-false}
+      BOOTSTRAP_ADMIN_EMAIL: ${BOOTSTRAP_ADMIN_EMAIL:-}
+      BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD:-}
+      BOOTSTRAP_ADMIN_NAME: ${BOOTSTRAP_ADMIN_NAME:-}
+      BOOTSTRAP_TENANT_NAME: ${BOOTSTRAP_TENANT_NAME:-}
+      BOOTSTRAP_TENANT_SLUG: ${BOOTSTRAP_TENANT_SLUG:-}
+      BOOTSTRAP_TENANT_SHORT: ${BOOTSTRAP_TENANT_SHORT:-}
+      BOOTSTRAP_TENANT_SECTOR: ${BOOTSTRAP_TENANT_SECTOR:-}
     depends_on:
       postgres:
         condition: service_healthy