feat(web): self-service cheie/creds + admin web + email signup (PRD 3.3b)

US-007: rute web proprii /cont/roteste-cheie + /cont/rar-creds scoped pe
sesiune (C13), sectiune "Contul meu" cu cheie afisata o data.
US-010: rol admin (users.is_admin) + require_admin->403 + CLI set-admin +
bootstrap primul cont=admin (count_admins in BEGIN IMMEDIATE, anti-race).
US-011: panou /admin (activare/dezactivare conturi, CSRF + PRG), link admin
+ logout pe dashboard.
US-012: app/email.py notify_signup best-effort degradat fara SMTP + config smtp_*.
Fix: migrare defensiva users.is_admin/email_verified in _migrate.

VERIFY x2 context curat (PASS) + /code-review high. 393 teste pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/web/auth_routes.py

@@ -13,7 +13,8 @@ from ..accounts import create_account
 from ..auth import create_api_key
 from ..config import get_settings
 from ..db import get_connection
-from ..users import create_user, verify_password
+from ..email import notify_signup
+from ..users import count_admins, create_user, list_admin_emails, verify_password
 from ..web.csrf import get_csrf_token, verify_csrf
 from ..web.ratelimit import check_rate_limit
 from ..web.session import clear_session, set_session
@@ -68,12 +69,15 @@ async def signup_post(
             name=name, cui=cui, email=email,
         ), status_code=422)
 
+    # Bootstrap admin: count_admins se citeste INAUNTRUL tranzactiei BEGIN IMMEDIATE,
+    # astfel lock-ul RESERVED serializeaza scriitorii si al doilea signup vede count==1.
     conn = get_connection()
     try:
         conn.execute("BEGIN IMMEDIATE")
         try:
+            is_first = count_admins(conn) == 0
             account_id = create_account(conn, name, cui.strip() or None, active=False)
-            user_id = create_user(conn, account_id, email, parola)
+            user_id = create_user(conn, account_id, email, parola, is_admin=is_first)
             api_key = create_api_key(conn, account_id)
             conn.execute("COMMIT")
         except Exception as exc:
@@ -90,6 +94,17 @@ async def signup_post(
     set_session(request, account_id, user_id)
     print(f"SIGNUP cont={account_id} email={email}", flush=True)
 
+    # Notificare email admin (best-effort, nu blocheaza signup-ul)
+    try:
+        conn2 = get_connection()
+        try:
+            admins = list_admin_emails(conn2)
+        finally:
+            conn2.close()
+        notify_signup(admins, account_id, email)
+    except Exception as exc_notify:
+        print(f"SIGNUP-NOTIFY exceptie neasteptata cont={account_id}: {type(exc_notify).__name__}", flush=True)
+
     return _TMPL.TemplateResponse(request, "signup.html", _ctx(
         request,
         csrf_token=get_csrf_token(request),