Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/app/api/admin_routes.py

@@ -23,13 +23,13 @@ def create_user():
     """Create a user + provision a password (invite). Admin or super-admin only."""
     data = request.get_json(silent=True) or {}
     name = (data.get("name") or "").strip()
-    email = (data.get("email") or "").strip().lower()
+    username = (data.get("username") or data.get("email") or "").strip().lower()
     password = data.get("password") or ""
     role = (data.get("role") or "user").strip()
     org_id = (data.get("org_id") or current_user().get("org_id") or "org-default").strip()
 
-    if not email or not password:
-        raise ApiError("email and password are required")
+    if not username or not password:
+        raise ApiError("username and password are required")
     if role not in Config.ROLES:
         raise ApiError(f"invalid role: {role}")
     # Only super_admin can create another admin/super_admin
@@ -38,7 +38,7 @@ def create_user():
         raise ApiError("only super_admin can grant admin roles", 403)
     try:
         user = _store().create_user(
-            org_id=org_id, email=email, password=password, name=name, role=role
+            org_id=org_id, username=username, password=password, name=name, role=role
         )
     except AuthError as exc:
         raise ApiError(str(exc))
@@ -57,14 +57,14 @@ def list_users():
     return jsonify({"users": users})
 
 
-@admin_bp.put("/users/<email>")
+@admin_bp.put("/users/<username>")
 @require_auth
 @require_roles("admin")
-def update_user(email: str):
+def update_user(username: str):
     data = request.get_json(silent=True) or {}
-    email = email.strip().lower()
+    username = username.strip().lower()
     actor = current_user()
-    target = _store().get_user_or_none(email)
+    target = _store().get_user_or_none(username)
     if not target:
         raise ApiError("user not found", 404)
 
@@ -75,14 +75,20 @@ def update_user(email: str):
             raise ApiError(f"invalid role: {role}")
         if actor.get("role") != "super_admin":
             raise ApiError("only super_admin can change roles")
-        _store().set_role(email, role)
+        _store().set_role(username, role)
 
     if "active" in data:
         if actor.get("role") != "super_admin":
             raise ApiError("only super_admin can activate/deactivate users")
-        _store().set_active(email, bool(data.get("active")))
+        _store().set_active(username, bool(data.get("active")))
 
     if "password" in data and data.get("password"):
-        _store().set_password(email, data.get("password"))
+        _store().set_password(username, data.get("password"))
 
-    return jsonify({"user": _store().public_user(_store().get_user(email))})
+    if "email" in data:
+        try:
+            _store().set_email(username, data.get("email"))
+        except AuthError as exc:
+            raise ApiError(str(exc))
+
+    return jsonify({"user": _store().public_user(_store().get_user(username))})

backend/app/api/auth_routes.py

@@ -1,4 +1,4 @@
-"""Auth routes: login + current user. No self-registration."""
+"""Auth routes: login, current user, first-time admin setup. No self-registration."""
 from __future__ import annotations
 
 from flask import Blueprint, jsonify, request
@@ -15,22 +15,53 @@ def _store():
     return current_app.extensions["user_store"]
 
 
+def _login_body(data: dict) -> str:
+    # Accept `username` (primary) or `email` (fallback), lower-cased.
+    return (data.get("username") or data.get("email") or "").strip().lower()
+
+
 @auth_bp.post("/login")
 def login():
     data = request.get_json(silent=True) or {}
-    email = (data.get("email") or "").strip().lower()
+    username = _login_body(data)
     password = data.get("password") or ""
-    if not email or not password:
-        raise ApiError("email and password are required")
+    if not username or not password:
+        raise ApiError("username and password are required")
     try:
-        user = _store().verify(email, password)
+        user = _store().verify(username, password)
         token = _store().issue_token(user)
     except AuthError as exc:
         raise ApiError(str(exc), 401)
-    return jsonify({"token": token, "user": _store().public_user(user)})
+    return jsonify({
+        "token": token,
+        "user": _store().public_user(user),
+        "must_setup": bool(user.get("must_setup")),
+    })
 
 
 @auth_bp.get("/me")
 @require_auth
 def me():
     return jsonify({"user": _store().public_user(current_user())})
+
+
+@auth_bp.post("/setup")
+@require_auth
+def setup():
+    """First-time admin setup: set email + change password, then clear must_setup."""
+    user = current_user()
+    data = request.get_json(silent=True) or {}
+    username = (data.get("username") or user.get("username") or user.get("id") or "").strip().lower()
+    email = (data.get("email") or "").strip()
+    new_password = data.get("password") or ""
+    if not email or not new_password:
+        raise ApiError("email and new password are required")
+    try:
+        updated = _store().complete_setup(username, email, new_password)
+    except AuthError as exc:
+        raise ApiError(str(exc), 400)
+    return jsonify({
+        "ok": True,
+        "user": _store().public_user(updated),
+        "must_setup": False,
+    })