Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/scripts/test_security.py

@@ -26,8 +26,7 @@ def main():
     client = app.test_client()
 
     # admin login (org-default)
-    client.post("/api/auth/login", json={"email": "admin@salestrainer.local", "password": "admin123"})
-    r = client.post("/api/auth/login", json={"email": "admin@salestrainer.local", "password": "admin123"})
+    r = client.post("/api/auth/login", json={"username": "admin", "password": "1234"})
     AT = r.get_json()["token"]
     AH = {"Authorization": f"Bearer {AT}"}
 
@@ -56,7 +55,7 @@ def main():
 
     # Cross-org IDOR: create org B + a group in org-default; org B user must be denied.
     client.post("/api/admin/users", json={
-        "name": "Other Admin", "email": "b-admin@x.com", "password": "pass123", "role": "admin"},
+        "name": "Other Admin", "username": "badmin", "password": "pass123", "role": "admin"},
         headers=AH)
     # Create a group as A (current default org)
     r = client.post("/api/groups", json={"product": "A product"}, headers=AH)
@@ -68,8 +67,8 @@ def main():
     # and admin cannot read a PERSONAL group belonging to a different user.
     # Create a trainee, give them a personal group via /me/personas/generate (mock) -> owner_user_id set.
     client.post("/api/admin/users", json={
-        "name": "Trainee T", "email": "t2@x.com", "password": "pass123", "role": "user"}, headers=AH)
-    r = client.post("/api/auth/login", json={"email": "t2@x.com", "password": "pass123"})
+        "name": "Trainee T", "username": "trainee2", "password": "pass123", "role": "user"}, headers=AH)
+    r = client.post("/api/auth/login", json={"username": "trainee2", "password": "pass123"})
     TT = r.get_json()["token"]
     TH = {"Authorization": f"Bearer {TT}"}
     # trainee creates own persona -> personal group owned by t2
@@ -81,8 +80,8 @@ def main():
     # The admin (different actor) must be able to access it (super_admin not needed; admin same org).
     # For a strict IDOR test, a DIFFERENT trainee must be denied. Create t3.
     client.post("/api/admin/users", json={
-        "name": "Trainee T3", "email": "t3@x.com", "password": "pass123", "role": "user"}, headers=AH)
-    r = client.post("/api/auth/login", json={"email": "t3@x.com", "password": "pass123"})
+        "name": "Trainee T3", "username": "trainee3", "password": "pass123", "role": "user"}, headers=AH)
+    r = client.post("/api/auth/login", json={"username": "trainee3", "password": "pass123"})
     T3T = r.get_json()["token"]
     T3H = {"Authorization": f"Bearer {T3T}"}
     # t3 tries to read t2's personal group personas -> must be denied (owner check)