fix(ungated-global): create settings secret with a valid backend FK

bootstrapUngatedGlobal wrote its seed marker into the mcpctl-system-settings
Secret, creating the row with the default backendId '' when it did not exist.
The Secret_backendId_fkey constraint is enforced at insert time, so on a DB
where that secret was absent, mcpd crash-looped on startup (P2003).

Fix: run the seed after bootstrapSecretBackends (so the default plaintext
backend exists) and set backendId to the resolved default on create. If no
backend exists at all, skip writing the marker rather than crash.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/mcpd/tests/bootstrap-ungated-global.test.ts

@@ -18,6 +18,10 @@ function mockPrisma(opts: { settingsData?: Record<string, unknown> | null } = {}
       update: vi.fn(async () => ({})),
       create: vi.fn(async () => ({})),
     },
+    secretBackend: {
+      findUnique: vi.fn(async () => ({ id: 'backend-default', name: 'default', isDefault: true })),
+      findFirst: vi.fn(async () => ({ id: 'backend-default', name: 'default', isDefault: true })),
+    },
     user: {
       upsert: vi.fn(async () => ({ id: 'sys-user-id', email: 'system@mcpctl.local' })),
     },
@@ -68,11 +72,12 @@ describe('bootstrapUngatedGlobal', () => {
   it('marks the seed as done in the system settings secret', async () => {
     await bootstrapUngatedGlobal(prisma);
 
-    // Settings secret didn't exist → created with the marker key
+    // Settings secret didn't exist → created with the marker key and a valid backend FK
     expect(prisma.secret.create).toHaveBeenCalledWith(
       expect.objectContaining({
         data: expect.objectContaining({
           name: SYSTEM_SETTINGS_SECRET,
+          backendId: 'backend-default',
           data: expect.objectContaining({ [SETTING_UNGATED_GLOBAL_SEEDED]: true }),
         }),
       }),