Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

backend/scripts/test_setup.py

@@ -0,0 +1,67 @@
+"""Test the first-time admin setup flow: admin/1234 -> must_setup -> set email+password."""
+import os
+import sys
+import tempfile
+import warnings
+from pathlib import Path
+
+warnings.filterwarnings("ignore", message="The HMAC key is")
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), ".."))
+
+tempdir = tempfile.mkdtemp(prefix="st_setup_")
+os.environ["DATA_DIR"] = tempdir
+os.environ["JWT_SECRET"] = "test-secret-key-0123456789abcdef"
+
+from app.factory import create_app  # noqa: E402
+from app.config import Config  # noqa: E402
+
+Config.DATA_DIR = Path(tempdir)
+Config.LLM_API_KEY = ""
+Config.LLM_BASE_URL = ""
+
+
+def main():
+    app = create_app()
+    client = app.test_client()
+
+    # 1. Default admin logs in with admin / 1234 and must_setup is true
+    r = client.post("/api/auth/login", json={"username": "admin", "password": "1234"})
+    assert r.status_code == 200, r.get_json()
+    assert r.get_json()["must_setup"] is True, "default admin should require setup"
+    token = r.get_json()["token"]
+    H = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/auth/me", headers=H).get_json()["user"]
+    assert me.get("must_setup") is True
+    print("[ok] default admin login admin/1234 -> must_setup=true")
+
+    # 2. Cannot set up with short password / bad email
+    r = client.post("/api/auth/setup", json={"username": "admin", "email": "bad", "password": "12"}, headers=H)
+    assert r.status_code == 400, r.get_json()
+    print("[ok] setup rejects bad email/short password")
+
+    # 3. Successful setup: email + new password, clears must_setup
+    r = client.post("/api/auth/setup", json={"username": "admin", "email": "admin@corp.com", "password": "NewPass!42"}, headers=H)
+    assert r.status_code == 200, r.get_json()
+    assert r.get_json()["must_setup"] is False
+    print("[ok] setup completes -> must_setup=false")
+
+    # 4. Old password no longer works; new one does
+    r = client.post("/api/auth/login", json={"username": "admin", "password": "1234"})
+    assert r.status_code == 401, "old default password should be invalid"
+    r = client.post("/api/auth/login", json={"username": "admin", "password": "NewPass!42"})
+    assert r.status_code == 200
+    new_token = r.get_json()["token"]
+    assert r.get_json()["must_setup"] is False
+    print("[ok] old password rejected; new password logs in")
+
+    # 5. Admin can now use the app (create user, etc.)
+    NH = {"Authorization": f"Bearer {new_token}"}
+    r = client.post("/api/admin/users", json={"name": "T1", "username": "t1", "password": "pass123", "role": "user"}, headers=NH)
+    assert r.status_code == 201, r.get_json()
+    print("[ok] admin can use the app after setup")
+
+    print("\nALL SETUP TESTS PASSED")
+
+
+if __name__ == "__main__":
+    main()