feat(setup): Stage 1 first-time setup wizard backend (no UI)

Task #534 — backend, infra, and tooling only. UI ships in Stage 2.

Backend
- New system_settings table (id=1 singleton): installed flag, base_url,
  local_domain, local_ip, https_mode, app_version. Pushed to dev DB.
- New /api/setup/status (open) and /api/setup/{validate,complete}
  (gated by requireSetupOpen — 409 once installed).
- completeInstall is fully transactional: pg_advisory_xact_lock
  serializes concurrent callers, double-gates on installed flag and
  admin existence, then atomically creates the admin user, assigns
  admin role + Admins/Everyone groups, and flips system_settings to
  installed=true. Rolls back on any failure.
- Zod validation, bcrypt hashing, in-memory rate limiter for the
  setup endpoints.

Backward compat
- scripts/src/seed.ts now branches on installed flag + admin
  existence + SEED_*_PASSWORD env vars. Legacy installs (admin
  exists, system_settings empty) get backfilled to installed=true
  via ON CONFLICT DO UPDATE so they are never forced through the
  wizard. When env passwords are unset and no admin exists, the
  seed prints a wizard hint instead of seeding.

Infra
- docker-compose.yml: replaced nginx edge with a Caddy service that
  mounts ./certs and ./docker/Caddyfile. The web service no longer
  publishes a port directly — Caddy is the only public ingress.
- docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with
  WebSocket upgrade preserved and a plaintext :80 fallback when
  HTTPS_MODE=skip (dev-only).
- .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT,
  HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional.

Tooling
- scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert,
  mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN).
  start.sh untouched.

Tests
- artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass
  (snapshot/restore admin role + system_settings around tests).
- scripts/tests/local-setup.test.mjs: 2/2 pass (first-run bootstrap
  + second-run no-op idempotency with mkcert/openssl stubs).

Constraints honored: no force-push, no destructive ops, start.sh
preserved, scripts idempotent, volumes/DB never touched, HTTPS skip
mode dev-only, wizard does not edit LOCAL_DOMAIN/LOCAL_IP.

Out of scope / not addressed: pre-existing TS errors in
routes/users.ts and pre-existing failure in
executive-meetings-postpone-race.test.mjs.

docker/Caddyfile

@@ -0,0 +1,62 @@
+# Tx OS — Caddy reverse proxy + TLS termination.
+#
+# Defaults (HTTPS_MODE=local or byo): listen on :443 with the mounted
+# certificate pair from /certs, redirect HTTP→HTTPS automatically.
+# When HTTPS_MODE=skip, we serve plaintext on :80 only (developer-only;
+# the host script never enables this in production paths).
+#
+# The site MUST stay single-origin so the API session cookie
+# (sameSite=lax) keeps working across SPA + /api requests.
+{
+	# Disable Caddy's automatic Let's Encrypt issuance — we always
+	# bring our own cert (mkcert locally, real cert in BYO mode).
+	auto_https disable_certs
+	admin off
+}
+
+(api_proxy) {
+	# WebSocket / Socket.IO upgrade for /api/socket.io
+	@websocket {
+		header Connection *Upgrade*
+		header Upgrade websocket
+	}
+	reverse_proxy /api/socket.io/* api:8080
+	reverse_proxy /api/* api:8080
+}
+
+(spa_proxy) {
+	# Static SPA bundle is served by the `web` container (nginx-alpine)
+	# on port 80 inside the docker network. Caddy is the public edge.
+	reverse_proxy web:80
+}
+
+# ---------- HTTPS site (default) ----------
+{$LOCAL_DOMAIN:tx.local}, {$LOCAL_IP:127.0.0.1} {
+	tls /certs/local-cert.pem /certs/local-key.pem
+	encode zstd gzip
+	import api_proxy
+	import spa_proxy
+}
+
+# Catch-all HTTPS host (covers raw IP / Tailscale name without
+# touching the named site).
+:443 {
+	tls /certs/local-cert.pem /certs/local-key.pem
+	encode zstd gzip
+	import api_proxy
+	import spa_proxy
+}
+
+# Plain HTTP — issue a permanent redirect to HTTPS in normal modes,
+# but become the actual site when HTTPS_MODE=skip.
+:80 {
+	@skip expression {$HTTPS_MODE:local} == "skip"
+	handle @skip {
+		encode zstd gzip
+		import api_proxy
+		import spa_proxy
+	}
+	handle {
+		redir https://{host}{uri} permanent
+	}
+}