Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/scripts/test_e2e.py

@@ -28,7 +28,7 @@ def main():
     client = app.test_client()
 
     # admin login
-    r = client.post("/api/auth/login", json={"email": "admin@salestrainer.local", "password": "admin123"})
+    r = client.post("/api/auth/login", json={"username": "admin", "password": "1234"})
     AT = r.get_json()["token"]
     AH = {"Authorization": f"Bearer {AT}"}
 
@@ -57,8 +57,8 @@ def main():
 
     # create a trainee
     client.post("/api/admin/users", json={
-        "name": "Trainee", "email": "t@x.com", "password": "pass123", "role": "user"}, headers=AH)
-    r = client.post("/api/auth/login", json={"email": "t@x.com", "password": "pass123"})
+        "name": "Trainee", "username": "trainee9", "password": "pass123", "role": "user"}, headers=AH)
+    r = client.post("/api/auth/login", json={"username": "trainee9", "password": "pass123"})
     UT = r.get_json()["token"]
     UH = {"Authorization": f"Bearer {UT}"}