fix(auth): satisfy errcheck and shadow lints in bootstrap tx scaffolding

The bootstrap-race fix introduced two new golangci-lint failures on the
new transaction scaffolding in CreateAdminIfNone (Lint Code is failing
on this PR for these reasons):

- `_ = tx.Rollback(ctx)` does not satisfy errcheck under this project's
  `check-blank: true` setting. Replace with the project-standard
  `defer tx.Rollback(ctx) //nolint:errcheck` pattern used in
  internal/config/store_postgres.go.
- `if _, err := tx.Exec(...)` on the advisory-lock acquire shadowed the
  outer `err` (govet shadow). Drop the short-declaration so the
  lock-exec assigns to the outer variable.

No behavior change on the success or known-error paths.

go test ./internal/auth/ -race: 577 passed.
golangci-lint on store_postgres.go: no new findings on the touched
lines.

Author: cristim

internal/auth/store_postgres.go

@@ -433,12 +433,13 @@ func (s *PostgresStore) CreateAdminIfNone(ctx context.Context, user *User) (bool
 		return false, fmt.Errorf("failed to begin admin bootstrap transaction: %w", err)
 	}
 	// Rollback is a no-op after a successful Commit; on any earlier return
-	// it also releases the advisory lock.
-	defer func() { _ = tx.Rollback(ctx) }()
+	// it also releases the advisory lock. Matches the project convention
+	// (e.g. internal/config/store_postgres.go) for deferred rollback.
+	defer tx.Rollback(ctx) //nolint:errcheck
 
 	// Serialize against concurrent bootstrap calls and against the
 	// min-one-admin deferred trigger (see adminInvariantAdvisoryLockKey).
-	if _, err := tx.Exec(ctx, "SELECT pg_advisory_xact_lock($1)", adminInvariantAdvisoryLockKey); err != nil {
+	if _, err = tx.Exec(ctx, "SELECT pg_advisory_xact_lock($1)", adminInvariantAdvisoryLockKey); err != nil {
 		return false, fmt.Errorf("failed to acquire admin bootstrap lock: %w", err)
 	}