feat(setup): Stage 1 first-time setup wizard backend (no UI)

Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535).

Backend
- New system_settings table (id=1 singleton): installed flag, base_url,
  local_domain, local_ip, https_mode, app_version. Pushed to dev DB.
- New /api/setup/status (open) and /api/setup/{validate,complete}
  (gated by requireSetupOpen — 409 once installed).
- completeInstall is fully transactional: pg_advisory_xact_lock
  serializes concurrent callers, double-gates on installed flag and
  admin existence, then atomically creates the admin user, assigns
  admin role + Admins/Everyone groups, and flips system_settings to
  installed=true. Rolls back on any failure.
- Added redirectIfSetupNeeded() helper returning the full SetupStatus
  payload alongside a redirect target for SPA routing decisions.
- Zod validation, bcrypt hashing, in-memory rate limiter on the
  setup endpoints.

Backward compat
- scripts/src/seed.ts now branches on installed flag + admin
  existence + SEED_*_PASSWORD env vars. Legacy installs (admin
  exists, system_settings empty) get backfilled to installed=true
  via ON CONFLICT DO UPDATE so they are never forced through the
  wizard. When env passwords are unset and no admin exists, the
  seed prints a wizard hint instead of seeding.

Infra
- docker-compose.yml: replaced nginx edge with a Caddy service that
  mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no
  longer publishes a port directly — Caddy is the only public ingress.
- Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when
  HTTPS_MODE=skip so a fresh host without mkcert can still boot.
- docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with
  WebSocket upgrade preserved and an HTTP→HTTPS redirect.
- start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert
  is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so
  the legacy http://localhost:${APP_PORT} URL keeps working. In
  local/byo mode it prints the https://${LOCAL_DOMAIN} URL.
- .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT,
  HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional.

Tooling
- scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert,
  mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN).

Tests
- artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass.
- scripts/tests/local-setup.test.mjs: 2/2 pass.

Constraints honored: no force-push, no destructive ops, start.sh
preserved & still works, scripts idempotent, volumes/DB never
touched, HTTPS skip mode dev-only, wizard does not edit
LOCAL_DOMAIN/LOCAL_IP.

Out of scope / not addressed: pre-existing TS errors in
routes/users.ts and pre-existing failure in
executive-meetings-postpone-race.test.mjs.

scripts/src/seed.ts

@@ -90,56 +90,22 @@ async function main() {
     }
   }
 
-  // ---------------------------------------------------------------------
-  // First-run install state — defer admin creation to the Setup Wizard
-  // when no admin exists yet AND the operator hasn't pre-seeded passwords
-  // via environment variables.
-  //
-  // Behaviour matrix:
-  //   installed=true OR admin exists  → seed roles/permissions only
-  //                                     (re-runs in CI / migrations stay
-  //                                      green; never overwrite a real
-  //                                      admin row)
-  //   installed=false, no admin, env  → behave as before: create the
-  //                                     seeded admin + sample user, flip
-  //                                     installed=true so the wizard does
-  //                                     not appear
-  //   installed=false, no admin, no
-  //   env                              → seed roles/permissions only,
-  //                                     leave admin creation to the
-  //                                     wizard. Print a clear log line.
-  // ---------------------------------------------------------------------
+  // First-run install state. The canonical bootstrap + legacy backfill
+  // live in the api-server startup hook (ensureSystemSettingsBootstrap),
+  // so they run on every boot regardless of whether seed is invoked.
+  // Here we only read the current flag to decide whether to create the
+  // seeded admin/user pair below.
   const adminPassword = process.env.SEED_ADMIN_PASSWORD;
   const userPassword = process.env.SEED_USER_PASSWORD;
 
-  // Ensure a single source-of-truth row in system_settings always
-  // exists at id=1. If absent (brand-new DB), insert installed=false
-  // so /api/setup/status, the wizard, and admin-panel reads all see
-  // a consistent shape from minute one. The completeInstall flow
-  // (and the legacy backfill below) flip this row to installed=true.
   await db
     .insert(systemSettingsTable)
     .values({ id: 1, installed: false })
     .onConflictDoNothing();
 
-  // Detect existing install state. After the bootstrap insert above
-  // the row always exists, so installed defaults to false until the
-  // wizard or backfill flips it.
   const sysRows = await db.select().from(systemSettingsTable).limit(1);
   const installedFlag = sysRows[0]?.installed ?? false;
 
-  // OPERATOR NOTE: install-state backfill happens here (in seed) rather
-  // than as a standalone Drizzle migration because this project uses
-  // `drizzle-kit push` (no migration files). Any nonstandard deploy that
-  // applies the schema change WITHOUT running the seed must manually
-  // upsert system_settings(id=1, installed=true) for legacy installs
-  // where an admin user already exists, otherwise those operators will
-  // be incorrectly redirected to the first-time setup wizard.
-  //
-  // Backfill: if any admin already exists but system_settings is empty
-  // (legacy installs from before this column shipped), upsert the row
-  // with installed=true so those operators are never forced through the
-  // wizard.
   const existingAdminRows = await db
     .select({ id: usersTable.id })
     .from(userRolesTable)
@@ -149,24 +115,6 @@ async function main() {
     .limit(1);
   const adminAlreadyExists = existingAdminRows.length > 0;
 
-  if (adminAlreadyExists && !installedFlag) {
-    // Use DO UPDATE so a stale id=1 row with installed=false (e.g. if a
-    // half-finished wizard run inserted the row first) is corrected to
-    // installed=true. Preserve installed_at if already set.
-    await db
-      .insert(systemSettingsTable)
-      .values({ id: 1, installed: true, installedAt: new Date() })
-      .onConflictDoUpdate({
-        target: systemSettingsTable.id,
-        set: {
-          installed: true,
-          installedAt: sql`COALESCE(${systemSettingsTable.installedAt}, NOW())`,
-          updatedAt: new Date(),
-        },
-      });
-    console.log("Backfilled system_settings.installed=true for existing admin");
-  }
-
   let adminUser: { id: number } | undefined;
   let regularUser: { id: number } | undefined;