feat(setup): Stage 1 first-time setup wizard backend (no UI)

Task #534 — backend, infra, and tooling only. UI ships in Stage 2.

Backend
- New system_settings table (id=1 singleton): installed flag, base_url,
  local_domain, local_ip, https_mode, app_version. Pushed to dev DB.
- New /api/setup/status (open) and /api/setup/{validate,complete}
  (gated by requireSetupOpen — 409 once installed).
- completeInstall is fully transactional: pg_advisory_xact_lock
  serializes concurrent callers, double-gates on installed flag and
  admin existence, then atomically creates the admin user, assigns
  admin role + Admins/Everyone groups, and flips system_settings to
  installed=true. Rolls back on any failure.
- Zod validation, bcrypt hashing, in-memory rate limiter for the
  setup endpoints.

Backward compat
- scripts/src/seed.ts now branches on installed flag + admin
  existence + SEED_*_PASSWORD env vars. Legacy installs (admin
  exists, system_settings empty) get backfilled to installed=true
  via ON CONFLICT DO UPDATE so they are never forced through the
  wizard. When env passwords are unset and no admin exists, the
  seed prints a wizard hint instead of seeding.

Infra
- docker-compose.yml: replaced nginx edge with a Caddy service that
  mounts ./certs and ./docker/Caddyfile. The web service no longer
  publishes a port directly — Caddy is the only public ingress.
- docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with
  WebSocket upgrade preserved and a plaintext :80 fallback when
  HTTPS_MODE=skip (dev-only).
- .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT,
  HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional.

Tooling
- scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert,
  mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN).
  start.sh untouched.

Tests
- artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass
  (snapshot/restore admin role + system_settings around tests).
- scripts/tests/local-setup.test.mjs: 2/2 pass (first-run bootstrap
  + second-run no-op idempotency with mkcert/openssl stubs).

Constraints honored: no force-push, no destructive ops, start.sh
preserved, scripts idempotent, volumes/DB never touched, HTTPS skip
mode dev-only, wizard does not edit LOCAL_DOMAIN/LOCAL_IP.

Out of scope / not addressed: pre-existing TS errors in
routes/users.ts and pre-existing failure in
executive-meetings-postpone-race.test.mjs.

.env.example

@@ -32,6 +32,30 @@ LOG_LEVEL=info
 # 32+ random bytes. Generate with `openssl rand -hex 32`. REQUIRED.
 SESSION_SECRET=change-me-session-secret-min-32-chars-please
 
+# -----------------------------------------------------------------------------
+# Local hostname / TLS (used by Caddy + the Setup Wizard)
+# -----------------------------------------------------------------------------
+# Hostname operators reach the system at on the LAN. The Caddy edge
+# binds this name and serves the mkcert-issued certificate.
+LOCAL_DOMAIN=tx.local
+# Auto-detected by scripts/local-setup.sh — the host's LAN IP. Used as
+# an additional SAN on the local certificate so phones / tablets that
+# can't resolve mDNS can still reach the system at https://<ip>/.
+LOCAL_IP=127.0.0.1
+# Canonical public URL the SPA + API are reachable at. Setup Wizard
+# stores this in system_settings.base_url at install time.
+BASE_URL=https://tx.local
+# Edge ports (Caddy). Set HTTP_PORT=8080 / HTTPS_PORT=8443 if you
+# can't bind privileged ports.
+HTTP_PORT=80
+HTTPS_PORT=443
+# TLS strategy:
+#   local — local-setup.sh provisions ./certs/local-{cert,key}.pem via mkcert
+#   byo   — operator drops their own cert/key into ./certs/ with the same names
+#   skip  — DEVELOPER ONLY: serve plaintext on :80, no HTTPS. Never use
+#           outside trusted local development networks.
+HTTPS_MODE=local
+
 # -----------------------------------------------------------------------------
 # SPA build (tx-os) — read by Vite at build time AND `pnpm --filter tx-os dev`
 # -----------------------------------------------------------------------------
@@ -92,12 +116,15 @@ LOCAL_STORAGE_ROOT=./storage
 LOCAL_STORAGE_SIGNING_SECRET=
 
 # -----------------------------------------------------------------------------
-# Seeded demo accounts
+# Seeded demo accounts (OPTIONAL since the Setup Wizard exists)
 # -----------------------------------------------------------------------------
-# Used only by `docker compose run --rm migrate` on first boot. REQUIRED in
-# production — the seed script throws if these are unset and NODE_ENV=production.
-SEED_ADMIN_PASSWORD=change-me-admin-password
-SEED_USER_PASSWORD=change-me-user-password
+# When BOTH variables are set, the migrate container creates an `admin`
+# and `ahmed` user with these passwords on first boot and immediately
+# marks the install complete (skipping the wizard). When EITHER is unset,
+# the seed creates only roles/permissions and leaves admin creation to
+# the first-run wizard at /setup.
+SEED_ADMIN_PASSWORD=
+SEED_USER_PASSWORD=
 
 # -----------------------------------------------------------------------------
 # Email (optional)