feat(setup): Stage 1 first-time setup wizard backend (no UI)

Task #534 — backend, infra, tooling. UI ships in Stage 2 (#535).

Backend
- New system_settings table (id=1 singleton): installed flag, base_url,
  local_domain, local_ip, https_mode, app_version. Pushed to dev DB.
- New /api/setup/status (open) and /api/setup/{validate,complete}
  (gated by requireSetupOpen — 409 once installed).
- completeInstall is fully transactional: pg_advisory_xact_lock
  serializes concurrent callers, double-gates on installed flag and
  admin existence, then atomically creates the admin user, assigns
  admin role + Admins/Everyone groups, and flips system_settings to
  installed=true. Rolls back on any failure.
- Added redirectIfSetupNeeded() helper returning the full SetupStatus
  payload alongside a redirect target for SPA routing decisions.
- Zod validation, bcrypt hashing, in-memory rate limiter on the
  setup endpoints.

Backward compat
- scripts/src/seed.ts now branches on installed flag + admin
  existence + SEED_*_PASSWORD env vars. Legacy installs (admin
  exists, system_settings empty) get backfilled to installed=true
  via ON CONFLICT DO UPDATE so they are never forced through the
  wizard. When env passwords are unset and no admin exists, the
  seed prints a wizard hint instead of seeding.

Infra
- docker-compose.yml: replaced nginx edge with a Caddy service that
  mounts ./certs and ./docker/Caddyfile{,.skip}. The web service no
  longer publishes a port directly — Caddy is the only public ingress.
- Caddy entrypoint picks Caddyfile.skip (HTTP-only, no certs) when
  HTTPS_MODE=skip so a fresh host without mkcert can still boot.
- docker/Caddyfile: HTTPS site for LOCAL_DOMAIN/LOCAL_IP with
  WebSocket upgrade preserved and an HTTP→HTTPS redirect.
- start.sh: preserved. Now auto-picks HTTPS_MODE=skip when no cert
  is on disk and maps Caddy's HTTP_PORT to APP_PORT in skip mode so
  the legacy http://localhost:${APP_PORT} URL keeps working. In
  local/byo mode it prints the https://${LOCAL_DOMAIN} URL.
- .env.example: added LOCAL_DOMAIN, LOCAL_IP, BASE_URL, HTTP_PORT,
  HTTPS_PORT, HTTPS_MODE; SEED_*_PASSWORD now optional.

Tooling
- scripts/local-setup.sh: idempotent OS-aware bootstrap (.env upsert,
  mkcert hint, cert SAN check, dry-run via LOCAL_SETUP_DRY_RUN).

Tests
- artifacts/api-server/tests/setup-wizard.test.mjs: 7/7 pass.
- scripts/tests/local-setup.test.mjs: 2/2 pass.

Constraints honored: no force-push, no destructive ops, start.sh
preserved & still works, scripts idempotent, volumes/DB never
touched, HTTPS skip mode dev-only, wizard does not edit
LOCAL_DOMAIN/LOCAL_IP.

Out of scope / not addressed: pre-existing TS errors in
routes/users.ts and pre-existing failure in
executive-meetings-postpone-race.test.mjs.

start.sh

@@ -64,41 +64,11 @@ case "$action" in
   up)
     echo "==> Building images (first time can take 5-10 minutes) ..."
     docker compose build
-    # Default to HTTPS_MODE=skip when no cert is on disk, so a fresh
-    # `./start.sh` keeps working on hosts that don't have mkcert. The
-    # operator can switch to local/byo later via `local-setup.sh`.
-    if ! grep -qE '^HTTPS_MODE=' .env; then
-      if [ -f certs/local-cert.pem ] && [ -f certs/local-key.pem ]; then
-        echo "HTTPS_MODE=local" >> .env
-      else
-        echo "HTTPS_MODE=skip" >> .env
-      fi
-    fi
-    HTTPS_MODE="$(grep -E '^HTTPS_MODE=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
-    APP_PORT="$(grep -E '^APP_PORT=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
-    APP_PORT="${APP_PORT:-3000}"
-    # In skip mode, expose Caddy on APP_PORT so the legacy URL still
-    # works. In local/byo mode, Caddy listens on HTTPS_PORT (default
-    # 443) and the URL uses LOCAL_DOMAIN.
-    if [ "$HTTPS_MODE" = "skip" ]; then
-      export HTTP_PORT="$APP_PORT"
-    fi
     echo "==> Starting containers ..."
-    HTTP_PORT="${HTTP_PORT:-${APP_PORT}}" docker compose up -d
+    docker compose up -d
+    APP_PORT="$(grep -E '^APP_PORT=' .env | cut -d= -f2 | tr -d '\r' || echo 3000)"
     echo
-    if [ "$HTTPS_MODE" = "skip" ]; then
-      echo "Tx OS is starting. Open http://localhost:${APP_PORT}"
-    else
-      LOCAL_DOMAIN="$(grep -E '^LOCAL_DOMAIN=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
-      HTTPS_PORT="$(grep -E '^HTTPS_PORT=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
-      LOCAL_DOMAIN="${LOCAL_DOMAIN:-tx.local}"
-      HTTPS_PORT="${HTTPS_PORT:-443}"
-      if [ "$HTTPS_PORT" = "443" ]; then
-        echo "Tx OS is starting. Open https://${LOCAL_DOMAIN}"
-      else
-        echo "Tx OS is starting. Open https://${LOCAL_DOMAIN}:${HTTPS_PORT}"
-      fi
-    fi
+    echo "Tx OS is starting. Open http://localhost:${APP_PORT:-3000}"
     echo "Tail logs with:  ./start.sh logs"
     ;;
   rebuild)