Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/app/factory.py

@@ -11,20 +11,24 @@ from .config import Config
 
 
 def bootstrap_admin(users: UserStore) -> None:
-    """Ensure a default org + super-admin exists on first run (no self-registration)."""
-    email = "admin@salestrainer.local"
+    """Ensure a default org + super-admin exists on first run (no self-registration).
+
+    Default admin logs in with username `admin` / `1234`, then MUST set an email
+    and change the password on first login (`must_setup=True`).
+    """
     org = users.orgs.get_or_none("org-default")
     if org is None:
         org = users.create_org("Default Organization", org_id="org-default")
-    if users.get_user_or_none(email) is None:
+    if users.get_user_or_none("admin") is None:
         users.create_user(
             org_id=org["id"],
-            email=email,
-            password="admin123",
+            username="admin",
+            password="1234",
             name="Super Admin",
             role="super_admin",
+            must_setup=True,
         )
-        print("[bootstrap] created default super-admin:", email, "/ admin123")
+        print("[bootstrap] created default super-admin: admin / 1234 (must set email + password)")
 
 
 def create_app() -> Flask: