fix(bootstrap): first-boot FK race + single-flight

[mmcintosh]

Description

On a fresh database's first boot, bootstrapMiddleware seeds system data in one Promise.all. In that batch, two steps create document_types rows while two others insert documents that reference them by foreign key.

When an insert wins the race, D1 throws FOREIGN KEY constraint failed and the per-step .catch() swallows it. RBAC roles and core plugins are silently left unseeded, and the admin gets "You do not have permission to access this area".

Bootstrap then writes its KV skip-marker anyway (24h TTL), which locks the broken state in. It happens on every first boot of a fresh D1: 11 of 11 local boots on main. A user also confirmed it on a production deploy of beta.28 (see #1017).

Fixes #1017. Refs #1054 (the "no permission" part).

Part of a batch of five login fixes: #1103 (Better Auth 1.7.7), #1104 (register-form credential row), #1105 (password changes reaching Better Auth) and #1063. The #1063 seed-admin gate should merge after this one.

Changes

All in packages/core/src/middleware/bootstrap.ts, plus a small change to services/plugin-bootstrap.ts:

• Two-phase seed. Document-type producers run and finish before the consumers that insert documents.
• Single-flight. Concurrent requests on the same cold isolate wait on one bootstrap instead of racing parallel ones.
• Marker only on success. The completion latch and KV marker are written only when every step succeeded.
• Hardening, added after an independent code review:
  • A cancelled first boot no longer stalls the isolate. Bootstrap runs under executionCtx.waitUntil. Waiting requests give up after 20s and carry on without bootstrapping, so a missing role means 403, not open access. A latch older than 60s is treated as dead.
  • Backoff after a failed run. The next full attempt waits at least 30s per isolate instead of re-running on every request. The telemetry snapshot is sent only after a successful run.
  • The KV fast path checks the seed, not just the marker. It trusts the marker only if this database has the role-admin document, plus the core-auth plugin document unless plugins are disabled. This matters in CI, where every PR preview shares one KV namespace and the marker key depends only on the version.
  • A failed core plugin install counts as a failed step. bootstrapCorePlugins() returns the failed ids. The limit is documented in the code: isBootstrapNeeded() looks only at core-* plugins, so for a bootstrapped plugin whose name doesn't start with core-, a failure blocks the marker for one run only. Widening it would reinstall plugins a user uninstalled.
  • Known gap: autoRegisterCollectionDocumentTypes still catches each collection's failure, so a failed collection type doesn't block the marker.

Conflict: #1097 also edits bootstrap.ts and conflicts with this PR in two places, including resetBootstrap(). Whichever merges second needs a rebase with a hand merge there; I'll do it. Once #1097 is in, the security-check calls this PR adds to the waiting and backoff paths can go, because #1097 runs the check on every request.

Testing

• bootstrap-fk-ordering.test.ts (real SQLite, foreign_keys = ON): on the pre-fix code, the end-to-end middleware case's RBAC seed hits FOREIGN KEY constraint failed, which is swallowed, so no roles are written and the test fails. It passes with the fix.

• bootstrap-resilience.test.ts (new, 8 tests) covers:

  • a hung run plus the timeout;
  • the stale latch;
  • the backoff count;
  • telemetry only on success;
  • the fast path rejecting a marker over an unseeded database;
  • no marker after a failed plugin install.

  Removing each fix fails exactly its own test.

• Fresh greenfield boots (clean D1 + empty KV), measured on the original commit 7b2151c25: a single first request gave zero FK errors and a fully seeded database, and four concurrent cold requests ran the bootstrap once. No unit test covers single-flight itself.

Unit Tests

• Added/updated unit tests
• All unit tests passing (this branch: 1742 / 0 on its base; all five batch PRs merged on current main: 2000 / 0)

E2E Tests

• Added/updated E2E tests. None added: CI creates a fresh D1 per run, but its readiness probe is the first request, before any spec runs, so a spec can't observe first boot. The unit tests above cover it with a real SQLite database.
• All E2E tests passing (not run locally, per the repo's E2E policy)

Screenshots/Videos

N/A. No UI changes.

Checklist

• Code follows project conventions
• Tests added/updated and passing
• Type checking passes
• No console errors or warnings
• Documentation updated (if needed): N/A

[mmcintosh]

Note on the red CI. The failing check here is the unit-test step (about 25 tests), and those failures are pre-existing on main — this branch is cut straight from current main, and none of them touch bootstrap.ts. They are the known beta.25 test-harness issue (a per-database cache leaks generated columns across in-memory test DBs, producing "no such column: q_*" errors) and are fixed by the test-infra PR (#1018, Fixes #1016). Type-check passes here, and this PR's purpose is to fix the E2E against preview failure: the loginAsAdmin timeout caused by the first-boot FK race that leaves the RBAC roles and core plugins unseeded (#1017). The two are a pair: #1018 fixes this PR's unit suite, and this PR fixes #1018's E2E preview. Recommend landing #1018 first, then this one — after both, CI is green across the stack.