Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/app/api/auth_routes.py

@@ -1,4 +1,4 @@
-"""Auth routes: login + current user. No self-registration."""
+"""Auth routes: login, current user, first-time admin setup. No self-registration."""
 from __future__ import annotations
 
 from flask import Blueprint, jsonify, request
@@ -15,22 +15,53 @@ def _store():
     return current_app.extensions["user_store"]
 
 
+def _login_body(data: dict) -> str:
+    # Accept `username` (primary) or `email` (fallback), lower-cased.
+    return (data.get("username") or data.get("email") or "").strip().lower()
+
+
 @auth_bp.post("/login")
 def login():
     data = request.get_json(silent=True) or {}
-    email = (data.get("email") or "").strip().lower()
+    username = _login_body(data)
     password = data.get("password") or ""
-    if not email or not password:
-        raise ApiError("email and password are required")
+    if not username or not password:
+        raise ApiError("username and password are required")
     try:
-        user = _store().verify(email, password)
+        user = _store().verify(username, password)
         token = _store().issue_token(user)
     except AuthError as exc:
         raise ApiError(str(exc), 401)
-    return jsonify({"token": token, "user": _store().public_user(user)})
+    return jsonify({
+        "token": token,
+        "user": _store().public_user(user),
+        "must_setup": bool(user.get("must_setup")),
+    })
 
 
 @auth_bp.get("/me")
 @require_auth
 def me():
     return jsonify({"user": _store().public_user(current_user())})
+
+
+@auth_bp.post("/setup")
+@require_auth
+def setup():
+    """First-time admin setup: set email + change password, then clear must_setup."""
+    user = current_user()
+    data = request.get_json(silent=True) or {}
+    username = (data.get("username") or user.get("username") or user.get("id") or "").strip().lower()
+    email = (data.get("email") or "").strip()
+    new_password = data.get("password") or ""
+    if not email or not new_password:
+        raise ApiError("email and new password are required")
+    try:
+        updated = _store().complete_setup(username, email, new_password)
+    except AuthError as exc:
+        raise ApiError(str(exc), 400)
+    return jsonify({
+        "ok": True,
+        "user": _store().public_user(updated),
+        "must_setup": False,
+    })