Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/scripts/test_m1.py

@@ -29,7 +29,7 @@ def main():
 
     # login as super-admin
     r = client.post("/api/auth/login", json={
-        "email": "admin@salestrainer.local", "password": "admin123"})
+        "username": "admin", "password": "1234"})
     assert r.status_code == 200, r.get_json()
     token = r.get_json()["token"]
     H = {"Authorization": f"Bearer {token}"}
@@ -64,8 +64,8 @@ def main():
 
     # trainee created; can list groups but only 'ready' ones (this one is 'failed' -> hidden)
     client.post("/api/admin/users", json={
-        "name": "Trainee", "email": "t@x.com", "password": "pass123", "role": "user"}, headers=H)
-    r = client.post("/api/auth/login", json={"email": "t@x.com", "password": "pass123"})
+        "name": "Trainee", "username": "trainee1", "password": "pass123", "role": "user"}, headers=H)
+    r = client.post("/api/auth/login", json={"username": "trainee1", "password": "pass123"})
     ut = r.get_json()["token"]
     UH = {"Authorization": f"Bearer {ut}"}
     r = client.get("/api/groups", headers=UH)