feat: first-run web installer with admin account creation

- Backend: app_settings table + users.is_admin flag (schema + migrate)
- POST /api/setup creates admin user, first workspace and marks installed
  (transactional, single-use, rate-limited); GET /api/setup/status
- Guard middleware: API answers 503 { setupRequired: true } until installed
- Frontend: /setup wizard (welcome, admin account, workspace), router guard
  redirects to installer when uninstalled, API interceptor handles 503
- Docs: installer covered in README, SETUP, HOSTING and ROADMAP

backend/package.json

@@ -2,6 +2,7 @@
   "name": "openstack-backend",
   "version": "0.1.0",
   "description": "Express + Socket.IO API for openStack",
+  "type": "module",
   "main": "src/index.js",
   "scripts": {
     "start": "node src/index.js",