fix(api): make install defaults migration-owned

[markwylde]

Summary

• add database migrations to own default settings, default clients, and org RBAC seeding
• remove runtime bulk seeding helpers from install paths
• update install completion flows to set only runtime-specific values (issuer/public origin/rp id and generated demo secret)
• simplify install model tests to focus on scope serialization/parsing behavior

Validation

• npm run tidy
• npm run build