Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/app/api/admin_routes.py

@@ -23,13 +23,13 @@ def create_user():
     """Create a user + provision a password (invite). Admin or super-admin only."""
     data = request.get_json(silent=True) or {}
     name = (data.get("name") or "").strip()
-    email = (data.get("email") or "").strip().lower()
+    username = (data.get("username") or data.get("email") or "").strip().lower()
     password = data.get("password") or ""
     role = (data.get("role") or "user").strip()
     org_id = (data.get("org_id") or current_user().get("org_id") or "org-default").strip()
 
-    if not email or not password:
-        raise ApiError("email and password are required")
+    if not username or not password:
+        raise ApiError("username and password are required")
     if role not in Config.ROLES:
         raise ApiError(f"invalid role: {role}")
     # Only super_admin can create another admin/super_admin
@@ -38,7 +38,7 @@ def create_user():
         raise ApiError("only super_admin can grant admin roles", 403)
     try:
         user = _store().create_user(
-            org_id=org_id, email=email, password=password, name=name, role=role
+            org_id=org_id, username=username, password=password, name=name, role=role
         )
     except AuthError as exc:
         raise ApiError(str(exc))
@@ -57,14 +57,14 @@ def list_users():
     return jsonify({"users": users})
 
 
-@admin_bp.put("/users/<email>")
+@admin_bp.put("/users/<username>")
 @require_auth
 @require_roles("admin")
-def update_user(email: str):
+def update_user(username: str):
     data = request.get_json(silent=True) or {}
-    email = email.strip().lower()
+    username = username.strip().lower()
     actor = current_user()
-    target = _store().get_user_or_none(email)
+    target = _store().get_user_or_none(username)
     if not target:
         raise ApiError("user not found", 404)
 
@@ -75,14 +75,20 @@ def update_user(email: str):
             raise ApiError(f"invalid role: {role}")
         if actor.get("role") != "super_admin":
             raise ApiError("only super_admin can change roles")
-        _store().set_role(email, role)
+        _store().set_role(username, role)
 
     if "active" in data:
         if actor.get("role") != "super_admin":
             raise ApiError("only super_admin can activate/deactivate users")
-        _store().set_active(email, bool(data.get("active")))
+        _store().set_active(username, bool(data.get("active")))
 
     if "password" in data and data.get("password"):
-        _store().set_password(email, data.get("password"))
+        _store().set_password(username, data.get("password"))
 
-    return jsonify({"user": _store().public_user(_store().get_user(email))})
+    if "email" in data:
+        try:
+            _store().set_email(username, data.get("email"))
+        except AuthError as exc:
+            raise ApiError(str(exc))
+
+    return jsonify({"user": _store().public_user(_store().get_user(username))})