feat: expose CRUD, onboarding, pubsub via web

lib/localiser/web/plugs/bootstrap_guard.ex

@@ -0,0 +1,19 @@
+defmodule Localiser.Web.Plugs.BootstrapGuard do
+  @moduledoc "Halts with 403 if any users already exist - protects POST /api/setup."
+  import Plug.Conn
+
+  alias Localiser.Domain.Users
+
+  def init(opts), do: opts
+
+  def call(conn, _opts) do
+    if Users.any?() do
+      conn
+      |> put_resp_content_type("application/json")
+      |> send_resp(403, ~s({"error":"system already initialised"}))
+      |> halt()
+    else
+      conn
+    end
+  end
+end