feat: first-run web installer with admin account creation

- Backend: app_settings table + users.is_admin flag (schema + migrate)
- POST /api/setup creates admin user, first workspace and marks installed
  (transactional, single-use, rate-limited); GET /api/setup/status
- Guard middleware: API answers 503 { setupRequired: true } until installed
- Frontend: /setup wizard (welcome, admin account, workspace), router guard
  redirects to installer when uninstalled, API interceptor handles 503
- Docs: installer covered in README, SETUP, HOSTING and ROADMAP

docs/HOSTING.md

@@ -122,6 +122,9 @@ curl http://localhost:3000/api/health
 - Frontend: `http://<host>:8080`
 - Backend API: `http://<host>:3000/api/health`
 - Data persists in the `pgdata` volume.
+- On first start, open the frontend and complete the **web installer**
+  (admin account + first workspace). Until then the API answers
+  `503 { setupRequired: true }` for all app routes.
 
 ### Reverse proxy (TLS) in front of Compose