Remove Legacy Credential Bootstrap Paths

Decouple user provisioning from HTTPS identity storage while retaining
compatible v1 user records and migrating TLS material to the
credential-free
v2 format. Add focused security regression coverage and update operator
documentation.

src/admin_ssh_console.c

@@ -538,7 +538,7 @@ static bool remote_command_allowed(const admin_request_t *request)
     /* Empty input is handled quietly by esp_console_run(), not UART0 policy. */
     bool allowed = true;
     if (argc >= 2U && strcmp(argv[0], "user") == 0 &&
-        (strcmp(argv[1], "bootstrap") == 0 || strcmp(argv[1], "recover") == 0)) {
+        strcmp(argv[1], "recover") == 0) {
         allowed = false;
     }
     /* Temporary browser policy until lifecycle acknowledgements/revocation are
@@ -716,7 +716,7 @@ static void worker_task(void *context)
         } else if (active) {
             (void)worker_write(&request.token,
                             request.token.transport == ADMIN_CONSOLE_TRANSPORT_WEB
-                                ? "Command is unavailable from the web console; use UART0 or SSH where permitted. Bootstrap/recovery require UART0.\r\n"
+                                ? "Command is unavailable from the web console; use UART0 or SSH where permitted. Recovery requires UART0.\r\n"
                                 : "Command is restricted to physical UART0.\r\n");
         }
         current = session_is_current(&request.token, &request.principal);