Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

frontend/src/api/index.js

@@ -33,11 +33,12 @@ async function request(method, url, body, isForm = false) {
 }
 
 export const api = {
-  login: (email, password) => request('POST', '/api/auth/login', { email, password }),
+  login: (username, password) => request('POST', '/api/auth/login', { username, password }),
   me: () => request('GET', '/api/auth/me'),
+  setup: (b) => request('POST', '/api/auth/setup', b),
   adminCreateUser: (b) => request('POST', '/api/admin/users', b),
   adminListUsers: () => request('GET', '/api/admin/users'),
-  adminUpdateUser: (email, b) => request('PUT', `/api/admin/users/${email}`, b),
+  adminUpdateUser: (username, b) => request('PUT', `/api/admin/users/${username}`, b),
   createGroup: (formData) => request('POST', '/api/groups', formData, true),
   listGroups: () => request('GET', '/api/groups'),
   getGroup: (id) => request('GET', `/api/groups/${id}`),