docs(bootstrap): clarify three-step Docker first-boot flow

Rework README and docker-compose comments to document the deliberate
chicken-and-egg escape: the `init` sidecar now only runs `migrate` and
`load_library_types`, leaving `setup_neo4j_indexes` as a manual step
after the system embedding model is configured in `/admin/`. This
avoids making `app` unreachable on first boot when no embedding model
row exists yet, while preserving loud failure on dimension mismatch.

docker/entrypoint.sh

@@ -50,7 +50,9 @@ case "$1" in
     ;;
 
   setup)
-    # One-shot init — Neo4j indexes + library_type seed data.
+    # One-shot init — Neo4j indexes + library_type seed data. Run this
+    # manually after the system embedding model has been configured in the
+    # admin (setup_neo4j_indexes reads vector dimensions from that row).
     python manage.py setup_neo4j_indexes
     python manage.py load_library_types
     ;;
@@ -58,12 +60,26 @@ case "$1" in
   init)
     # Bundled one-shot init run by the `init` sidecar on every
     # `docker compose up`. Idempotent: re-runs are no-ops unless migrations
-    # or indexes need to change. A non-zero exit here blocks `app`, `mcp`,
-    # and `worker` from starting, which is the point — we'd rather fail
-    # loudly than serve silent zero-result searches.
+    # or library_type defaults need to change. A non-zero exit here blocks
+    # `app`, `mcp`, and `worker` from starting.
+    #
+    # Neo4j vector-index creation is *deliberately not* bundled here. That
+    # command (``setup_neo4j_indexes``) requires a system embedding model
+    # with a configured ``vector_dimensions`` value, and that model is
+    # data an operator configures through the Django admin after first
+    # boot. On a fresh stack there is no such row yet, so blocking the
+    # whole stack on it would make the admin unreachable — a chicken-and-
+    # egg. Operator bootstrap flow:
+    #
+    #   1. docker compose up           # init sidecar: migrate + load_library_types
+    #   2. browse to admin, configure system embedding model
+    #   3. docker compose exec app python manage.py setup_neo4j_indexes
+    #
+    # Until step 3 runs, vector search will return empty results — the
+    # readiness check in library/apps.py logs a warning when indexes are
+    # missing so this is visible, not silent.
     set -e
     python manage.py migrate --noinput
-    python manage.py setup_neo4j_indexes
     python manage.py load_library_types
     ;;