feat(setup): Stage 1 first-time setup wizard backend (no UI)

Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535).

Backend
- New system_settings table (id=1 singleton): installed flag, base_url,
  local_domain, local_ip, https_mode, app_version. Pushed to dev DB.
- New /api/setup/status (open) and /api/setup/{validate,complete}
  (gated by requireSetupOpen — 409 once installed).
- completeInstall is fully transactional: pg_advisory_xact_lock
  serializes concurrent callers, double-gates on installed flag and
  admin existence, then atomically creates the admin user, assigns
  admin role + Admins/Everyone groups, and flips system_settings to
  installed=true. Rolls back on any failure.
- Added redirectIfSetupNeeded() helper returning the full SetupStatus
  payload alongside a redirect target for SPA routing decisions.
- Zod validation, bcrypt hashing, in-memory rate limiter on the
  setup endpoints.

Backward compat
- scripts/src/seed.ts now branches on installed flag + admin
  existence + SEED_*_PASSWORD env vars. Legacy installs (admin
  exists, system_settings empty) get backfilled to installed=true
  via ON CONFLICT DO UPDATE so they are never forced through the
  wizard. When env passwords are unset and no admin exists, the
  seed prints a wizard hint instead of seeding.

Infra
- docker-compose.yml: replaced nginx edge with a Caddy service that
  mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no
  longer publishes a port directly — Caddy is the only public ingress.
- Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when
  HTTPS_MODE=skip so a fresh host without mkcert can still boot.
- docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with
  WebSocket upgrade preserved and an HTTP→HTTPS redirect.
- start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert
  is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so
  the legacy http://localhost:${APP_PORT} URL keeps working. In
  local/byo mode it prints the https://${LOCAL_DOMAIN} URL.
- .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT,
  HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional.

Tooling
- scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert,
  mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN).

Tests
- artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass.
- scripts/tests/local-setup.test.mjs: 2/2 pass.

Constraints honored: no force-push, no destructive ops, start.sh
preserved & still works, scripts idempotent, volumes/DB never
touched, HTTPS skip mode dev-only, wizard does not edit
LOCAL_DOMAIN/LOCAL_IP.

Out of scope / not addressed: pre-existing TS errors in
routes/users.ts and pre-existing failure in
executive-meetings-postpone-race.test.mjs.

artifacts/api-server/src/index.ts

@@ -3,6 +3,7 @@ import { Server as SocketIOServer } from "socket.io";
 import type { IncomingMessage, ServerResponse } from "http";
 import app, { sessionMiddleware } from "./app";
 import { logger } from "./lib/logger";
+import { ensureSystemSettingsBootstrap } from "./lib/setupService";
 
 const rawPort = process.env["PORT"];
 
@@ -58,6 +59,15 @@ io.on("connection", (socket) => {
   });
 });
 
-httpServer.listen(port, () => {
-  logger.info({ port }, "Server listening");
-});
+// Run install-state bootstrap before accepting traffic so the wizard
+// gate is always consistent with the DB on the first request, even
+// when the schema was applied without running the seed script.
+ensureSystemSettingsBootstrap()
+  .catch((err) => {
+    logger.error({ err }, "ensureSystemSettingsBootstrap failed (continuing)");
+  })
+  .finally(() => {
+    httpServer.listen(port, () => {
+      logger.info({ port }, "Server listening");
+    });
+  });

artifacts/api-server/src/lib/setupService.ts

@@ -344,9 +344,43 @@ export async function completeInstall(
   }
 }
 
-// Lightweight gate used by the SPA router (and any other consumer) that
-// wants to know "should I redirect to /setup?". Mirrors readStatus()'s
-// rules so the answer is consistent.
+// Bootstrap idempotently called from index.ts at server start. Ensures
+// system_settings(id=1) exists and backfills installed=true for legacy
+// installs where an admin already exists. Migration-safe: runs on every
+// boot regardless of whether the seed script was invoked.
+export async function ensureSystemSettingsBootstrap(): Promise<void> {
+  const client = await pool.connect();
+  try {
+    await client.query(
+      `INSERT INTO system_settings (id, installed)
+         VALUES (1, false)
+       ON CONFLICT (id) DO NOTHING`,
+    );
+    const sys = await client.query<{ installed: boolean }>(
+      `SELECT installed FROM system_settings WHERE id = 1 LIMIT 1`,
+    );
+    if (sys.rows[0]?.installed) return;
+    const adminCount = await client.query<{ id: number }>(
+      `SELECT u.id FROM users u
+         JOIN user_roles ur ON ur.user_id = u.id
+         JOIN roles r ON r.id = ur.role_id
+         WHERE r.name = 'admin' LIMIT 1`,
+    );
+    if ((adminCount.rowCount ?? 0) > 0) {
+      await client.query(
+        `UPDATE system_settings
+            SET installed = true,
+                installed_at = COALESCE(installed_at, NOW()),
+                updated_at = NOW()
+          WHERE id = 1`,
+      );
+    }
+  } finally {
+    client.release();
+  }
+}
+
+// Should the SPA router redirect to /setup? Mirrors readStatus().
 export async function isSetupOpen(): Promise<boolean> {
   try {
     const sys = await getSystemSettings();
@@ -357,11 +391,8 @@ export async function isSetupOpen(): Promise<boolean> {
   }
 }
 
-// Companion to isSetupOpen() that returns the full SetupStatus payload
-// alongside the redirect decision so the SPA router (and any other
-// caller making a redirect choice) gets a single, authoritative answer
-// without making two requests. `shouldRedirect` is true iff the wizard
-// should be shown — i.e. setup is open AND the DB check succeeded.
+// Returns the full SetupStatus + a single redirect decision so callers
+// don't have to make two requests.
 export async function redirectIfSetupNeeded(): Promise<{
   shouldRedirect: boolean;
   target: "/setup" | null;

artifacts/api-server/src/middlewares/setupGate.ts

@@ -2,19 +2,10 @@ import type { Request, Response, NextFunction } from "express";
 import { db } from "@workspace/db";
 import { systemSettingsTable } from "@workspace/db";
 
-// Blocks /api/setup/{validate,complete} once the system is installed.
-// /api/setup/status is intentionally NOT guarded — the SPA must always
-// be able to read install state to decide its routing.
-//
-// Gate semantics: this middleware uses `system_settings.installed` as
-// the SINGLE source of truth, per the Stage 1 contract. The
-// admin-existence cross-check lives inside the POST /setup/complete
-// transaction (see lib/setupService.ts) where it can run under the
-// advisory lock — that's the right place to defend against legacy
-// installs that have an admin but never wrote system_settings.
-// Backfill (in scripts/src/seed.ts) ensures any such legacy install
-// flips system_settings.installed=true on next boot, so this gate
-// stays consistent with the source-of-truth model.
+// Gate /api/setup/{validate,complete} on system_settings.installed
+// (the single source of truth). The admin-existence cross-check
+// lives inside the POST /setup/complete transaction.
+// /api/setup/status is intentionally NOT guarded.
 export async function requireSetupOpen(
   _req: Request,
   res: Response,