Add fleet setup template and a one-shot project bootstrap script

SETUP.local.md.example is a fill-in-the-blanks runbook for rolling
keep out across real machines and projects (gitignored once copied to
SETUP.local.md — real vault keys/recipient ids/hostnames are fleet
topology, not something to commit). bootstrap-project.sh wraps push +
grant --read-only for one or more recipients into a single call for
onboarding a new project vault.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/bootstrap-project.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Pushes a project's first env file and grants read-only access to one
+# or more already-registered recipients (typically the VPS boxes that
+# will deploy it), in one call.
+#
+# Usage:
+#   ./bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]
+#
+# The pusher (this machine's identity) becomes the vault's first,
+# read-write recipient automatically — see IMPLEMENTATION.md. Every
+# recipient-id argument here is granted read-only; run `keep grant`
+# by hand afterward for anyone who needs write access too.
+set -euo pipefail
+
+vault="${1:?usage: bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]}"
+file="${2:?usage: bootstrap-project.sh <vault> <env-file> <recipient-id> [recipient-id...]}"
+shift 2
+
+if [ "$#" -eq 0 ]; then
+  echo "error: at least one recipient id is required" >&2
+  exit 1
+fi
+
+keep push "$vault" --file "$file"
+
+for recipient in "$@"; do
+  keep grant "$vault" "$recipient" --read-only
+done
+
+echo ""
+echo "done. verify with: KEEP_ADMIN_PASSWORD=... keep overview"