Complete onboarding

Marks the caller’s workspace as having completed onboarding, which lifts the onboarding gate that otherwise blocks normal API access for a new workspace. The operation is idempotent: it only sets the completion timestamp if onboarding was not already complete. Admin only (returns 403 otherwise). Returns a simple ok acknowledgement.