feat: first-run web installer with admin account creation

- Backend: app_settings table + users.is_admin flag (schema + migrate)
- POST /api/setup creates admin user, first workspace and marks installed
  (transactional, single-use, rate-limited); GET /api/setup/status
- Guard middleware: API answers 503 { setupRequired: true } until installed
- Frontend: /setup wizard (welcome, admin account, workspace), router guard
  redirects to installer when uninstalled, API interceptor handles 503
- Docs: installer covered in README, SETUP, HOSTING and ROADMAP

README.md

@@ -59,8 +59,9 @@ cd frontend && npm install && npm run dev
 # -> http://localhost:5173
 ```
 
-Default dev flow creates the first user via **Register** in the UI; that user can then
-create workspaces and invite others by email (invited email must have an account).
+Open the frontend: on first start a **web installer** guides you through creating the
+admin account and your first workspace. Afterwards the team registers via the UI
+and joins workspaces by email invite (invited email must have an account).
 
 ## Quick start (Docker Compose)