First-run account setup

Create the single manager operator account. After this, the app will only allow username/password login and will use that identity to authorize access to /openclaw.