Secure initial Roller setup with one-time operator token

[snoopdave]

Summary

• Require a cryptographically secure, one-time operator token before Roller initial setup, database installation actions, and first-user registration.
• Bind redemption to a browser session, expire it after 60 minutes, and prevent token exposure through URLs or rendered responses.
• Permanently close bootstrap access after the first administrator is committed, including after account deletion or disablement.
• Gate SSO auto-provisioning during bootstrap and document the operator workflow.
• On upgrade, the database upgrade screen is not shown unless there is an actual database upgrade to be done.

Validation

• mvn -pl app -DskipTests compile
• Focused BootstrapSecurityTest and InstallTest
• git diff --check

New log messages

Here's what the new seucurity code looks like in roller.log:

New security code page

And here's the new securoty code page:

Release consideration

If we do an RC4, we should consider including this PR in that release candidate.

[snoopdave]

PR-Review: 1 inline blocking comment posted.

[snoopdave]

🐞Codex Issue: Blocking: The gate only matches /register.rol and /register!save.rol, but Struts dynamic method invocation also exposes URLs such as /register!execute.rol and /register!activate.rol. Those direct routes can reach the initial registration flow without the token. Gate the resolved register action/method (or reject all register methods while bootstrap is incomplete) and add regression coverage for every allowed method.

[snoopdave]

PR-Review: General Issues

The following issue needs action but is not tied to one changed line:

• 🐞Codex Issue: Important: The new bootstrap security logic has only a completion-state unit test. Add focused tests for successful and replayed redemption, expiry, session binding, invalid methods, concurrent redemption, restart behavior, and direct Struts route variants before merging.

[snoopdave]

Need to test this on the 5.2 -> 6.1.6 upgrade, that is the last actual DB schema change