Platform admin

Use the bootstrap secret from PLATFORM_ADMIN_API_KEY, or an operator key shown when an admin creates a user (format pp_…_…).