Activate the multi-instance fixture through the current account contract

Why: the synced backend rejects password-bearing user create, so the shared-PG acceptance could not open its first account.
Evidence: Backend CI run 3261 succeeded on 8c60ed0; Dev test-pg run 3263 failed in TestTwoInstancesOverSharedPG before this change.
Impact: test setup only. Alice remains a non-admin account and still receives an API key after setting a password.
Refs: Agent-System-Dev pulls/558
Co-authored-by: Cursor <cursoragent@cursor.com>

tests/integration/multi-instance/multi_instance_test.go

@@ -40,7 +40,6 @@ import (
 
 const (
 	aliceOwner = "mi_alice"
-	alicePass0 = "mi-alice-pass-0"
 	alicePass  = "mi-alice-pass-1"
 	httpWait   = 15 * time.Second
 )
@@ -435,22 +434,29 @@ func (e *env) killNine(t *testing.T, inst *instance) {
 
 // loginAlice 引导 alice 账号并发放 API key（CLI 直连测试库；key 存共享 PG，
 // 对两实例同时有效——程序化验收的首选凭证，SSE 亦可用 ?key= 兜底）。
-// 建号后 must_change=1：API Key 在改密完成前不能走业务接口（login_keys 门禁），
-// 故先经会话完成 alicePass0→alicePass，再发 Key。
+// 当前基座拒绝带密码的 user create：空库先 bootstrap 一位开库管理员，再为
+// alice 发放激活凭据。凭据兑换后设置 alicePass，然后才能发 API Key。
 func (e *env) loginAlice(t *testing.T) *userClient {
 	t.Helper()
-	e.cli(t, "user", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "Alice", "--password", alicePass0)
+	e.cli(t, "user", "bootstrap-admin", "--dsn", e.dbDSN, "--owner", "mi_setup", "--name", "Setup",
+		"--out-file", filepath.Join(t.TempDir(), "setup-grant"))
+	grantFile := filepath.Join(t.TempDir(), "alice-grant")
+	e.cli(t, "user", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "Alice", "--out-file", grantFile)
+	grantRaw, err := os.ReadFile(grantFile)
+	if err != nil {
+		t.Fatal(err)
+	}
 	jar, err := cookiejar.New(nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	sess := &http.Client{Timeout: httpWait, Jar: jar}
-	// e.uc 尚未赋值 → baseFor 走 A；会话 cookie 落 jar 后改密清 must_change。
-	e.do(t, sess, "POST", "/api/auth/login", map[string]any{
-		"owner": aliceOwner, "password": alicePass0,
+	// e.uc 尚未赋值 → baseFor 走 A；激活会话 cookie 落 jar 后设置密码。
+	e.do(t, sess, "POST", "/api/auth/login-key/redeem", map[string]any{
+		"key": strings.TrimSpace(string(grantRaw)),
 	}, nil)
 	e.do(t, sess, "POST", "/api/auth/password", map[string]any{
-		"current": alicePass0, "next": alicePass,
+		"next": alicePass,
 	}, nil)
 
 	key := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "mi-acceptance")