Enforcing API tokens (f4482fd5) had a sharp edge: on a brand-new config dir
there is no token, so every /v1 call is refused, AND no user, so nobody can
log in to create one. Nothing in the codebase auto-creates that first user —
grepped for it rather than assumed.

The app now creates a single `admin` account at startup when auth.json has
no users, with a random password printed once and must_change_password set,
and logs plainly when there are users but no tokens. Idempotent: verified it
never touches an existing user or rewrites its hash.

The guide gains "You never configure a pod — CoderAI does": a table of what
the orchestrator sets on a rented pod by itself (the per-pool cra- token so
a pod is never open, TLS from this install's CA, seed models, engine args
including tensor-parallel and LoRA modules, admission limits, the volume
mount, idle teardown and the reaper) and the rule that follows — no SSH into
a pod, no client pointed at a pod URL; throughput comes from max_pods and
scale_up_inflight_per_pod, not from hammering one pod.

Also corrects the guide's first-run text, which promised credentials the
code did not actually create until now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>