feat(setup): Stage 1 first-time setup wizard backend (no UI)

Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535).

Backend
- New system_settings table (id=1 singleton): installed flag, base_url,
  local_domain, local_ip, https_mode, app_version. Pushed to dev DB.
- New /api/setup/status (open) and /api/setup/{validate,complete}
  (gated by requireSetupOpen — 409 once installed).
- completeInstall is fully transactional: pg_advisory_xact_lock
  serializes concurrent callers, double-gates on installed flag and
  admin existence, then atomically creates the admin user, assigns
  admin role + Admins/Everyone groups, and flips system_settings to
  installed=true. Rolls back on any failure.
- Added redirectIfSetupNeeded() helper returning the full SetupStatus
  payload alongside a redirect target for SPA routing decisions.
- Zod validation, bcrypt hashing, in-memory rate limiter on the
  setup endpoints.

Backward compat
- scripts/src/seed.ts now branches on installed flag + admin
  existence + SEED_*_PASSWORD env vars. Legacy installs (admin
  exists, system_settings empty) get backfilled to installed=true
  via ON CONFLICT DO UPDATE so they are never forced through the
  wizard. When env passwords are unset and no admin exists, the
  seed prints a wizard hint instead of seeding.

Infra
- docker-compose.yml: replaced nginx edge with a Caddy service that
  mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no
  longer publishes a port directly — Caddy is the only public ingress.
- Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when
  HTTPS_MODE=skip so a fresh host without mkcert can still boot.
- docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with
  WebSocket upgrade preserved and an HTTP→HTTPS redirect.
- start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert
  is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so
  the legacy http://localhost:${APP_PORT} URL keeps working. In
  local/byo mode it prints the https://${LOCAL_DOMAIN} URL.
- .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT,
  HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional.

Tooling
- scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert,
  mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN).

Tests
- artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass.
- scripts/tests/local-setup.test.mjs: 2/2 pass.

Constraints honored: no force-push, no destructive ops, start.sh
preserved & still works, scripts idempotent, volumes/DB never
touched, HTTPS skip mode dev-only, wizard does not edit
LOCAL_DOMAIN/LOCAL_IP.

Out of scope / not addressed: pre-existing TS errors in
routes/users.ts and pre-existing failure in
executive-meetings-postpone-race.test.mjs.

artifacts/api-server/tests/setup-wizard.test.mjs

@@ -237,3 +237,66 @@ test("GET /api/setup/status reports setupRequired=false after install", async ()
   assert.equal(body.installed, true);
   assert.equal(body.setupRequired, false);
 });
+
+// Regression: scripts/src/seed.ts inserts a bootstrap (id=1, installed=false)
+// row early. The seeded-admin branch later flips installed=true. The flip
+// MUST be a DO UPDATE — a DO NOTHING would silently leave installed=false
+// because the row already exists. This test exercises the same SQL the
+// seed uses so a future refactor cannot regress that behavior.
+test("seed flip from installed=false to installed=true uses DO UPDATE", async () => {
+  // Save current row to restore at the end so we don't disturb other tests.
+  const before = await pool.query("SELECT * FROM system_settings WHERE id = 1");
+  const beforeRow = before.rows[0] ?? null;
+
+  // Step 1: bootstrap insert (mirrors seed lines 123-126).
+  await pool.query(
+    `INSERT INTO system_settings (id, installed) VALUES (1, false)
+     ON CONFLICT (id) DO UPDATE SET installed = false, installed_at = NULL`,
+  );
+  const mid = await pool.query(
+    "SELECT installed FROM system_settings WHERE id = 1",
+  );
+  assert.equal(mid.rows[0].installed, false, "bootstrap should leave installed=false");
+
+  // Step 2: seeded-admin branch flip (mirrors seed lines 217-227).
+  await pool.query(
+    `INSERT INTO system_settings (id, installed, installed_at)
+     VALUES (1, true, NOW())
+     ON CONFLICT (id) DO UPDATE SET
+       installed = true,
+       installed_at = COALESCE(system_settings.installed_at, NOW()),
+       updated_at = NOW()`,
+  );
+  const after = await pool.query(
+    "SELECT installed, installed_at FROM system_settings WHERE id = 1",
+  );
+  assert.equal(after.rows[0].installed, true, "seed flip must set installed=true");
+  assert.ok(after.rows[0].installed_at !== null, "installed_at must be set");
+
+  // Restore.
+  if (beforeRow) {
+    await pool.query(
+      `INSERT INTO system_settings (id, installed, installed_at, base_url, local_domain, local_ip, https_mode, app_version, updated_at)
+       VALUES (1, $1, $2, $3, $4, $5, $6, $7, $8)
+       ON CONFLICT (id) DO UPDATE SET
+         installed = EXCLUDED.installed,
+         installed_at = EXCLUDED.installed_at,
+         base_url = EXCLUDED.base_url,
+         local_domain = EXCLUDED.local_domain,
+         local_ip = EXCLUDED.local_ip,
+         https_mode = EXCLUDED.https_mode,
+         app_version = EXCLUDED.app_version,
+         updated_at = EXCLUDED.updated_at`,
+      [
+        beforeRow.installed,
+        beforeRow.installed_at,
+        beforeRow.base_url,
+        beforeRow.local_domain,
+        beforeRow.local_ip,
+        beforeRow.https_mode,
+        beforeRow.app_version,
+        beforeRow.updated_at,
+      ],
+    );
+  }
+});

scripts/src/seed.ts

@@ -207,11 +207,21 @@ async function main() {
       .returning();
     regularUser = insertedRegular[0];
 
-    // Mark install complete so the wizard does not appear.
+    // Mark install complete so the wizard does not appear. The
+    // bootstrap insert at the top of this script always wrote
+    // (id=1, installed=false), so a plain onConflictDoNothing here
+    // would leave installed=false. Use DO UPDATE to actually flip it.
     await db
       .insert(systemSettingsTable)
       .values({ id: 1, installed: true, installedAt: new Date() })
-      .onConflictDoNothing();
+      .onConflictDoUpdate({
+        target: systemSettingsTable.id,
+        set: {
+          installed: true,
+          installedAt: sql`COALESCE(${systemSettingsTable.installedAt}, NOW())`,
+          updatedAt: new Date(),
+        },
+      });
 
     console.log("Users created");
   }