Use the bootstrap-created administrator account. Public sign-up stays disabled.
OAuth can be added later inside Better Auth. The first slice starts with an explicit password bootstrap flow.
This surface is private. If you need the first account, use the bootstrap-admin runbook from the repository root.