Function bootstrap_startup_settings 

pub(crate) async fn bootstrap_startup_settings(
    client: &Client,
) -> Result<(), AppError>

Seed all first-boot settings and bake Tier-B settings into process config.

Environment seeding is best-effort by design. Tier-B reads are startup critical: silently falling back would permanently replace administrator- configured limits until the next restart.