feat: first-run web installer with admin account creation

- Backend: app_settings table + users.is_admin flag (schema + migrate)
- POST /api/setup creates admin user, first workspace and marks installed
  (transactional, single-use, rate-limited); GET /api/setup/status
- Guard middleware: API answers 503 { setupRequired: true } until installed
- Frontend: /setup wizard (welcome, admin account, workspace), router guard
  redirects to installer when uninstalled, API interceptor handles 503
- Docs: installer covered in README, SETUP, HOSTING and ROADMAP

docs/ROADMAP.md

@@ -3,6 +3,7 @@
 ## Phase 1 — Web app MVP (this repo, v0.1) ✅
 
 - [x] Auth (register/login/JWT), workspaces, invites, roles
+- [x] First-run web installer (admin account + first workspace, API locked until done)
 - [x] Nested pages, TipTap rich text, comments, search
 - [x] Socket.IO realtime (live updates, presence, typing)
 - [x] Light/dark mode