docs(drasl): record admin bootstrap + config-key/CORS/NMSR gotchas

Capture what this session learned the hard way, in plan/03-drasl.md and CLAUDE.md:

- Correct admin key is DefaultAdmins (not DefaultAdminUsernames); wrong/unknown
  keys are silently ignored by drasl (logged as "unknown config option").
- CORSAllowOrigins must be top-level, before any [Section], or it's ignored.
- First-admin bootstrap under invite mode is a chicken-egg → temp-flip
  RequireInvite=false, register, revert.
- NMSR needs the auth. host-gateway pin + https mojank endpoints or avatars
  render the default skin (cross-ref plan/19-routes.md).
- Fix the stale example config and mark the admin-bootstrap task done.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -156,7 +156,9 @@ Full design settled across WS1–WS6; all tasks unchecked, ready to execute.
   names, no categories/links; feeds the "50+" stat tile.
 - [ ] Server-side perf mods (C2ME, etc.).
 - [ ] **Verify NeoForge version** against current stable before first deploy.
-- [ ] **Bootstrap Drasl admin** account.
+- [x] **Bootstrap Drasl admin** account (`admin`, 2026-06-10). Key is
+  `DefaultAdmins` (not `DefaultAdminUsernames`); first admin needs an invite-flip.
+  See `plan/03-drasl.md` gotchas.
 
 ## Reference URLs