These are fantastic questions! That is exactly right - the first user to log in is always an admin, regardless of auth provider. That is mentioned briefly in the "Sign In!" section here, for more context:
https://docs.rstudio.com/connect/admin/getting-started.html#initial-configuration
The first account will be marked as an RStudio Connect administrator. Please use this account to configure mail sending. These settings are necessary in order for Connect to be able to distribute reports and notify users of errors running their content. Connect also sends confirmation messages when using the default password auth provider.
On a HA setup, you just have to remember that we are talking about the Connect database. In an HA load balanced Connect environment, all servers are using the same database, so the first user to log into any of the Connect nodes will become the "first login" admin.
The second and further users will have their role chosen from the "DefaultRole"
If you need to change any of this after the fact, you can use the usermanager
CLI to change user roles. You can also use the Connect UI to change user roles (once you are an admin), or the Connect Server API.