PR: Ensure Admin scope/collections at startup so Admin user can be seeded

[swapnil-medblocks]

Summary

• Admin collections must exist at application startup so the system can reliably seed the initial Admin user and persist authentication configuration (OAuth signing key) before any other runtime features depend on them.
• This PR restores a clean FhirBucketService and adds idempotent helpers that guarantee the Admin scope and required admin collections are created early in the startup flow.

What changed

• Replaced corrupted FhirBucketService.java with a focused, tested implementation that supports admin-first startup.

• Key admin-focused methods added / restored:

  • ensureAdminCollections(connectionName, bucketName) — idempotently creates the Admin scope and configured admin collections.
  • areAdminCollectionsPresent(connectionName, bucketName) — checks presence so startup logic can decide whether to seed.
  • getAdminCollections() — resolves configured admin collections (falls back to config, users, tokens, clients, cache, bulk_groups).
  • createInitialAdminUserIfNeeded() — seeds admin user from config.yaml only after admin collections exist.
  • createOAuthSigningKey(...) — persists in-memory OAuth key to Admin.config after admin collections exist and verifies it was saved.

• Conversion & indexing helpers were restored but intentionally limited so admin provisioning can be executed independently of full FHIR conversion.

Why admin collections must be created at startup

• Admin seeding depends on durable storage:
  • The initial Admin user is stored in Admin.users — if Admin scope/collections do not exist, seeding will fail or be inconsistent.
  • OAuth signing key persistence requires Admin.config to be present so tokens survive restarts.
• Startup ordering: separating admin collection creation from resource conversion prevents a race where admin seeding is skipped or attempted on missing collections.
• Idempotence: ensureAdminCollections is safe to run at every startup — it no-ops when collections already exist, enabling robust automated provisioning (CI, dev VMs, ephemeral environments).
• Operational control: Operators can choose to run full FHIR conversion later (manually or via controller) without blocking basic admin provisioning.

Behavior guarantees

• Admin collection creation and admin user seeding are:
  • Idempotent — repeated runs do not error if collections or user already exist.
  • Conditional — initial admin user only created when admin.email is set and the user does not already exist.
  • Verifiable — OAuth key persistence reads the saved document back and attempts to parse the JWKSet.

Files changed

• backend/src/main/java/com/couchbase/admin/fhirBucket/service/FhirBucketService.java (rewritten)
  • Focus: admin creation & seeding helpers plus safe support methods.