Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/scripts/test_routes.py

@@ -24,8 +24,8 @@ def main():
     app = create_app()
     rules = sorted({str(rule) for rule in app.url_map.iter_rules() if str(rule).startswith("/api")})
     expected = [
-        "/api/auth/login", "/api/auth/me",
-        "/api/admin/users", "/api/admin/users/<email>",
+        "/api/auth/login", "/api/auth/me", "/api/auth/setup",
+        "/api/admin/users", "/api/admin/users/<username>",
         "/api/groups", "/api/groups/<gid>",
         "/api/groups/<gid>/analyze", "/api/groups/<gid>/personas",
         "/api/groups/<gid>/personas/<pid>", "/api/groups/<gid>/personas/<pid>",