Bootstrap

Materialise visitor ab_arms and mirror them into cookies.

Body:

• device_id (optional; falls back to the explee_device_id cookie). Empty/missing → 400 — nothing to bucket. Capped at 64 chars (see :class:BootstrapRequest).
• missing (optional list of exp ids to enrol into; defaults to all active visitor experiments).
• overrides (optional {exp_id: arm}; honoured only when _is_override_allowed returns True).

Side effects:

• find_or_create_guest_user(device_id) — race-safe insert.
• Override pass (if allowed): JSONB-merge over existing keys (REWRITE semantics).
• Enrol pass: JSONB-merge skipping any key already present (snapshot lock).
• Set-Cookie ab_<exp_id>=<arm> for every key in the response on the host's cookie-domain (.explee.com / .explee.local / host-only on localhost or sandbox env).

Returns the post-write {exp_id: arm} snapshot. Idempotent — calling twice yields the same result (and emits the same Set-Cookies).