Fresh installs: self-registered users get no role, so they lack api_tokens.use #488

api_tokens (#455, #484) maps api_tokens.use onto the standard user role. On a fresh install, users who sign up through /users/register are not attached to any role, so they can't open the tokens page or mint a personal access token until an admin assigns a role by hand.

users.bootstrap.ensure_user_role exists and the seed migration inserts the user role, but registration doesn't attach it (only the demo/seed user paths do).

Fix direction: decide whether registration should attach the default user role (likely, matching the demo flow), or make the default role for new users a setting. Add a test: register → GET the tokens page → 200.

Found during QA of #484.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4