fix(deploy): login 500s on fresh container

Two bugs kept a fresh docker-compose deploy from ever accepting admin:admin:

1. resolveSqliteUrl in packages/db/src/client.ts stripped leading slashes
   wholesale — so file:/data/vector.db became a relative path and was
   resolved against packages/db/prisma/. Prisma CLI (migrate deploy)
   correctly wrote to /data/vector.db on the mounted volume; the app's
   runtime client connected to an empty file at packages/db/prisma/data/
   vector.db with no tables, so login threw. The helper now passes Unix
   absolute paths through verbatim, still normalizes file:/// triple-
   slash URLs, and only resolves truly relative paths against the schema
   dir.

2. The Dockerfile CMD ran migrations but not a seed, so even when the
   path bug is fixed the User table is empty — admin:admin 401s forever.
   Added packages/db/ensure-admin.mjs (pure JS, no tsx needed) that
   creates the default admin user iff User.count() === 0, and wired it
   into the API CMD between migrate deploy and node. Credentials can be
   overridden with SEED_ADMIN_{USERNAME,PASSWORD,EMAIL}.

packages/db/ensure-admin.mjs

@@ -0,0 +1,30 @@
+// Bootstrap seed run at container start. Creates a default admin user
+// when the User table is empty so a fresh deployment has something to
+// log into. Subsequent boots see an existing user and skip silently.
+import bcrypt from 'bcryptjs';
+import { prisma } from './dist/client.js';
+
+try {
+  const count = await prisma.user.count();
+  if (count === 0) {
+    const username = process.env.SEED_ADMIN_USERNAME ?? 'admin';
+    const password = process.env.SEED_ADMIN_PASSWORD ?? 'admin';
+    const email = process.env.SEED_ADMIN_EMAIL ?? 'admin@vector.local';
+    await prisma.user.create({
+      data: {
+        username,
+        email,
+        passwordHash: await bcrypt.hash(password, 12),
+        role: 'ADMIN',
+      },
+    });
+    console.log(`[seed] Created default admin user "${username}". Change this password immediately.`);
+  } else {
+    console.log(`[seed] ${count} user(s) already exist — skipping default admin seed.`);
+  }
+} catch (err) {
+  console.error('[seed] Failed to ensure admin user:', err);
+  process.exit(1);
+} finally {
+  await prisma.$disconnect();
+}