nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

## Summary `POST /api/users/onboarding/finish` is registered as **anonymous (unauthenticated)** and creates a user with **full ReadWrite admin permissions**. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. ## Affected component - Endpoint: `POST /api/users/onboarding/finish` - Route registration: `api/user/routes.go:49` → `authorizer.AllowAnonymous(http.MethodPost, "/api/users/onboarding/finish")` - Handler: `api/user/onboarding_finish_handler.go` ## Technical details The route is explicitly allowed without authentication: ```go // api/user/routes.go:48-49 authorizer.AllowAnonymous(http.MethodGet, "/api/users/onboarding/status") authorizer.AllowAnonymous(http.MethodPost, "/api/users/onboarding/finish") ``` The handler reads the onboarding state, returns 403 if already finished, and otherwise creates a user with every permission set to ReadWrite: ```go // api/user/onboarding_finish_handler.go func (h onboardingFinishHandler) handle(ctx *gin.Context) { alreadyFinished, err := h.commands.OnboardingCompleted(ctx.Request.Context()) // (1) CHECK if err != nil { panic(err) } if alreadyFinished { ctx.Status(http.StatusForbidden) return } requestPayload := &use