fix(auth): bound scrypt params, cap concurrency, evict rate-limit keys, re-bootstrap admin

feat(users): add UsersRepo with admin bootstrap and password management