Add username-based login + mandatory first-time admin setup; push-ready

- User id/login = username (was email). Email is a separate settable field.
- Default admin: username admin / password 1234, must_setup=True.
- Login forces /setup on first login: set email + change password, then clears must_setup.
- New /api/auth/setup endpoint; JWT sub = username; admin routes use username.
- Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new
  password + confirm), i18n EN/TH.
- Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.

frontend/src/store/auth.js

@@ -5,6 +5,7 @@ import { getToken, setToken, api } from '../api'
 export const auth = reactive({
   user: null,
   token: getToken(),
+  mustSetup: false,
   get role() {
     return this.user ? this.user.role : null
   },
@@ -16,23 +17,33 @@ export const auth = reactive({
     try {
       const data = await api.me()
       this.user = data.user
+      this.mustSetup = !!data.user?.must_setup
       return this.user
     } catch (e) {
       this.user = null
+      this.mustSetup = false
       setToken(null)
       return null
     }
   },
-  async login(email, password) {
-    const data = await api.login(email, password)
+  async login(username, password) {
+    const data = await api.login(username, password)
     this.token = data.token
     setToken(data.token)
     this.user = data.user
+    this.mustSetup = !!data.must_setup
+    return data.user
+  },
+  async finishSetup(email, password) {
+    const data = await api.setup({ username: this.user.username || this.user.id, email, password })
+    this.user = data.user
+    this.mustSetup = false
     return data.user
   },
   logout() {
     this.user = null
     this.token = null
+    this.mustSetup = false
     setToken(null)
   },
 })